Merge branch 'PHP-8.3'

* PHP-8.3: [ci skip] NEWS Fix GH-13891: memleak and segfault when using ini_set with session.trans_sid_hosts (#13892)
php · Apr 6, 2024 · cf31332 · cf31332
2 parents 0a0e806 + eb244fc
commit cf31332
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 2 deletions.
diff --git a/ext/session/tests/gh13891.phpt b/ext/session/tests/gh13891.phpt
@@ -0,0 +1,17 @@
+--TEST--
+GH-13891 (memleak and segfault when using ini_set with session.trans_sid_hosts)
+--INI--
+session.use_cookies=0
+session.use_only_cookies=0
+session.use_trans_sid=1
+session.trans_sid_hosts=php.net
+--EXTENSIONS--
+session
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php
+// We *must* set it here because the bug only triggers on a runtime edit
+ini_set('session.trans_sid_hosts','php.net');
+?>
+--EXPECT--
diff --git a/ext/standard/url_scanner_ex.re b/ext/standard/url_scanner_ex.re
@@ -138,9 +138,10 @@ static int php_ini_on_update_hosts(zend_ini_entry *entry, zend_string *new_value
 		}
 		keylen = q - key;
 		if (keylen > 0) {
-			tmp_key = zend_string_init(key, keylen, 0);
+			/* Note: the hash table is persistently allocated, so the strings must be too! */
+			tmp_key = zend_string_init(key, keylen, true);
 			zend_hash_add_empty_element(hosts, tmp_key);
-			zend_string_release_ex(tmp_key, 0);
+			zend_string_release_ex(tmp_key, true);
 		}
 	}
 	efree(tmp);