[php-src] PR #25387: Fix uploaded files leak in request_parse_body()
| From: | dunglas | Date: | Wed, 11 Nov 2026 13:54:08 +0000 |
| Subject: | [php-src] PR #25387: Fix uploaded files leak in request_parse_body() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40538@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25387
Author: dunglas
While working on the "[Request lifecycle hooks for SAPIs with a worker
mode](https://wiki.php.net/rfc/request_lifecycle_hooks)" RFC, I discovered a bug affecting
existing SAPIs.
Calling
request_parse_body() on a multipart request whose body was already parsed
replaces SG(rfc1867_uploaded_files) with a new instance. This happens when the body was
parsed at startup (POST with enable_post_data_reading=1), or when the userland
request_parse_body() function is called several times.
The files from the previous parses are then lost. This patch reuses the existing table instead.
Related to #24802 and #24987, but neither the same bug nor the same fix.
AI: Claude Code used to find the issue and write the patch.