From 0eb6a4d32f961eddd83b7404faa7868ef9b7f9fb Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Tue, 23 Dec 2025 12:46:06 -0500 Subject: [PATCH 1/2] ext/session/mod_mm.c: add a few missing ZSTR macros In eaee504c the session's save_path global was changed to a zend_string pointer, but there are a few direct char-pointer accesses in ext/session/mod_mm.c that slipped through the cracks. GCC-15 notices them and fails to build due to the incompatible pointer types. Three ZSTR_* wrappers are all that is needed. Gentoo-Bug: https://bugs.gentoo.org/967862 Closes GH-20772. --- NEWS | 3 +++ ext/session/mod_mm.c | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index 676e7bac4e557..a28ef5f450d32 100644 --- a/NEWS +++ b/NEWS @@ -40,6 +40,9 @@ PHP NEWS . Fix build on legacy OpenSSL 1.1.0 systems. (Giovanni Giacobbi) . Fixed bug #74154 (Phar extractTo creates empty files). (ndossche) +- Session: + . Fix support for MM module. (Michael Orlitzky) + - Sqlite3: . Fixed bug GH-20699 (SQLite3Result fetchArray return array|false, null returned). (ndossche, plusminmax) diff --git a/ext/session/mod_mm.c b/ext/session/mod_mm.c index b997a2bdcff54..b794be646961a 100644 --- a/ext/session/mod_mm.c +++ b/ext/session/mod_mm.c @@ -264,7 +264,7 @@ static void ps_mm_destroy(ps_mm *data) PHP_MINIT_FUNCTION(ps_mm) { - size_t save_path_len = strlen(PS(save_path)); + size_t save_path_len = ZSTR_LEN(PS(save_path)); size_t mod_name_len = strlen(sapi_module.name); size_t euid_len; char *ps_mm_path, euid[30]; @@ -284,8 +284,8 @@ PHP_MINIT_FUNCTION(ps_mm) /* Directory + '/' + File + Module Name + Effective UID + \0 */ ps_mm_path = emalloc(save_path_len + 1 + (sizeof(PS_MM_FILE) - 1) + mod_name_len + euid_len + 1); - memcpy(ps_mm_path, PS(save_path), save_path_len); - if (save_path_len && PS(save_path)[save_path_len - 1] != DEFAULT_SLASH) { + memcpy(ps_mm_path, ZSTR_VAL(PS(save_path)), save_path_len); + if (save_path_len && ZSTR_VAL(PS(save_path))[save_path_len - 1] != DEFAULT_SLASH) { ps_mm_path[save_path_len] = DEFAULT_SLASH; save_path_len++; } From 13d63d610551431077e090da0e42694e93fc57c1 Mon Sep 17 00:00:00 2001 From: Niels Dossche <7771979+ndossche@users.noreply.github.com> Date: Tue, 23 Dec 2025 19:14:28 +0100 Subject: [PATCH 2/2] Fix GH-20771: Assertion failure when getUnicodeHost() returns empty string If nothing was added to a smart_str, the interned empty string is returned, and therefore ZVAL_NEW_STR is wrong as it'll set the REFCOUNTED flag. Closes GH-20773. --- NEWS | 4 ++++ ext/uri/tests/whatwg/getters/gh20771.phpt | 14 ++++++++++++++ ext/uri/uri_parser_whatwg.c | 2 +- 3 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 ext/uri/tests/whatwg/getters/gh20771.phpt diff --git a/NEWS b/NEWS index a28ef5f450d32..9ea0ffa9bbe2d 100644 --- a/NEWS +++ b/NEWS @@ -50,6 +50,10 @@ PHP NEWS - Standard: . Fix error check for proc_open() command. (ndossche) +- URI: + . Fixed bug GH-20771 (Assertion failure when getUnicodeHost() returns + empty string). (ndossche) + 18 Dec 2025, PHP 8.5.1 - Core: diff --git a/ext/uri/tests/whatwg/getters/gh20771.phpt b/ext/uri/tests/whatwg/getters/gh20771.phpt new file mode 100644 index 0000000000000..19f1d1fb0f500 --- /dev/null +++ b/ext/uri/tests/whatwg/getters/gh20771.phpt @@ -0,0 +1,14 @@ +--TEST-- +GH-20771 (Assertion failure when getUnicodeHost() returns empty string) +--EXTENSIONS-- +uri +--FILE-- +getUnicodeHost()); + +?> +--EXPECT-- +string(0) "" diff --git a/ext/uri/uri_parser_whatwg.c b/ext/uri/uri_parser_whatwg.c index 2e9ffad22d463..055f130af7c65 100644 --- a/ext/uri/uri_parser_whatwg.c +++ b/ext/uri/uri_parser_whatwg.c @@ -365,7 +365,7 @@ static zend_result php_uri_parser_whatwg_host_read(void *uri, php_uri_component_ lxb_url_serialize_host_unicode(&lexbor_idna, &lexbor_uri->host, serialize_to_smart_str_callback, &host_str); lxb_unicode_idna_clean(&lexbor_idna); - ZVAL_NEW_STR(retval, smart_str_extract(&host_str)); + ZVAL_STR(retval, smart_str_extract(&host_str)); break; } case PHP_URI_COMPONENT_READ_MODE_NORMALIZED_ASCII: