GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Fix GH-24802: guard request_parse_body() against reentrancy by lazerg · Pull Request #24987 · php/php-src

Conversation

@lazerg

@lazerg lazerg commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

request_parse_body() has no reentrancy guard. If a user error handler that fires during multipart parsing calls it again, the nested parse re-inits and destroys the process-global PG(rfc1867_protected_variables). The outer parse then uses and frees that same table a second time, so the worker crashes on a bad zend_string_release().

The function already keeps its state in SG(request_parse_body_context), so I added an in_progress flag there. A reentrant call now throws RequestParseBodyException instead of parsing again, and the flag is cleared on exit and at the per-request reset points.

Fixes #24802

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@lazerg
lazerg requested a review from bukka as a code owner October 28, 2026 01:52
@lazerg
Fix phpGH-24802: guard request_parse_body() against reentrancy
b9355c4
@lazerg
lazerg force-pushed the fix/gh-24802 branch from 948cef9 to b9355c4 Compare October 28, 2026 01:54
@github-actions github-actions Bot added Extension: standard SAPI: cli ABI break labels Oct 28, 2026
@dunglas dunglas mentioned this pull request Nov 11, 2026
Fix uploaded files leak in request_parse_body() #25387
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bukka bukka Awaiting requested review from bukka bukka is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

ABI break Extension: standard SAPI: cli

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@lazerg
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.