Skip to content

sapi: don't crash when SAPI functions are called from opcache.preload - #23839

Open
lacatoire wants to merge 1 commit into
php:masterfrom
lacatoire:fix/preload-apache-headers-null-ctx
Open

lacatoire wants to merge 1 commit into
php:masterfrom
lacatoire:fix/preload-apache-headers-null-ctx

Conversation

@lacatoire

@lacatoire lacatoire commented Sep 22, 2026

Copy link
Copy Markdown
Member

A preload script runs before any request, so SG(server_context) is NULL. Several apache2handler functions and SAPI hooks that opcache does not swap out during preloading dereferenced it unconditionally (apache_getenv(), apache_setenv(), apache_note(), apache_request_headers()/getallheaders(), apache_response_headers(), php_apache_sapi_get_stat(), php_apache_sapi_read_post()), crashing the server at startup. The cli-server's own apache_request_headers() has the same pattern.

Make each of them tolerate a NULL context, returning the neutral value their contract already allows, the same way php_apache_lookup_uri() and php_apache_sapi_getenv() already did.

PHP_MINFO_FUNCTION(apache) has the same issue but needs a broader change; left out of this fix.

A preload script runs during server startup, before any request, so
SG(server_context) is NULL. Several apache2handler functions and SAPI
hooks that opcache does not swap out during preloading dereferenced it
unconditionally: apache_getenv(), apache_setenv(), apache_note(),
apache_request_headers()/getallheaders(), apache_response_headers(),
php_apache_sapi_get_stat() (reached by getmyuid()) and
php_apache_sapi_read_post() (reached by php://input). Calling any of
them from a preload script crashed the server at startup.

The cli-server's own apache_request_headers() has the same pattern.

Make each of them tolerate a NULL context: the array-returning
functions return an empty array, the bool/string-returning ones warn
and return false, and the two SAPI hooks return the neutral value
their contract already allows for a failure (NULL for get_stat(), 0
bytes read for read_post()), the same way php_apache_lookup_uri() and
php_apache_sapi_getenv() already did.

The phpinfo() module info section (PHP_MINFO_FUNCTION(apache)) has the
same unchecked dereference but needs a broader change to stay useful
without a request; left out of this fix.

Fixes #2493
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant