From 09c54e04cdd9432dcda9b62ac4b60e7a90720d11 Mon Sep 17 00:00:00 2001 From: Marcel Hernandez Date: Tue, 22 Sep 2026 00:09:01 +0200 Subject: [PATCH 1/3] fpm: fix potential null dereference in fpm_status_export_to_zval() --- sapi/fpm/fpm/fpm_status.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sapi/fpm/fpm/fpm_status.c b/sapi/fpm/fpm/fpm_status.c index ff6ef68f3949..da907a9d1af1 100644 --- a/sapi/fpm/fpm/fpm_status.c +++ b/sapi/fpm/fpm/fpm_status.c @@ -56,6 +56,9 @@ int fpm_status_export_to_zval(zval *status) int i; scoreboard_p = fpm_scoreboard_copy(NULL, 1); + if (!scoreboard_p) { + return -1; + } now_epoch = time(NULL); fpm_clock_get(&now); From 92ba388e8868992450d570229482dc3c26cfdbee Mon Sep 17 00:00:00 2001 From: Marcel Hernandez Date: Thu, 24 Sep 2026 00:06:14 +0200 Subject: [PATCH 2/3] fpm: fix a use-after-free of scoreboard_p --- sapi/fpm/fpm/fpm_status.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sapi/fpm/fpm/fpm_status.c b/sapi/fpm/fpm/fpm_status.c index da907a9d1af1..f030bb309ae4 100644 --- a/sapi/fpm/fpm/fpm_status.c +++ b/sapi/fpm/fpm/fpm_status.c @@ -187,13 +187,13 @@ int fpm_status_handle_request(void) /* {{{ */ } if (scoreboard_p->idle < 0 || scoreboard_p->active < 0) { - fpm_scoreboard_free_copy(scoreboard_p); zlog(ZLOG_ERROR, "[pool %s] invalid status values", scoreboard_p->pool); SG(sapi_headers).http_response_code = 500; sapi_add_header_ex(ZEND_STRL("Content-Type: text/plain"), 1, 1); sapi_add_header_ex(ZEND_STRL("Expires: Thu, 01 Jan 1970 00:00:00 GMT"), 1, 1); sapi_add_header_ex(ZEND_STRL("Cache-Control: no-cache, no-store, must-revalidate, max-age=0"), 1, 1); PUTS("Internal error. Please review log file for errors."); + fpm_scoreboard_free_copy(scoreboard_p); return 1; } From cfad1b4d9fbb17b6d23ced2ffd1262c2a718fe35 Mon Sep 17 00:00:00 2001 From: Marcel Hernandez Date: Thu, 24 Sep 2026 00:08:37 +0200 Subject: [PATCH 3/3] fpm: fix _GET_str memory leaks and test headers_only status path --- sapi/fpm/fpm/fpm_status.c | 3 +++ sapi/fpm/tests/status-head.phpt | 40 +++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) create mode 100644 sapi/fpm/tests/status-head.phpt diff --git a/sapi/fpm/fpm/fpm_status.c b/sapi/fpm/fpm/fpm_status.c index f030bb309ae4..118be47bfeee 100644 --- a/sapi/fpm/fpm/fpm_status.c +++ b/sapi/fpm/fpm/fpm_status.c @@ -183,6 +183,7 @@ int fpm_status_handle_request(void) /* {{{ */ sapi_add_header_ex(ZEND_STRL("Expires: Thu, 01 Jan 1970 00:00:00 GMT"), 1, 1); sapi_add_header_ex(ZEND_STRL("Cache-Control: no-cache, no-store, must-revalidate, max-age=0"), 1, 1); PUTS("Internal error. Please review log file for errors."); + zend_string_release_ex(_GET_str, 0); return 1; } @@ -193,6 +194,7 @@ int fpm_status_handle_request(void) /* {{{ */ sapi_add_header_ex(ZEND_STRL("Expires: Thu, 01 Jan 1970 00:00:00 GMT"), 1, 1); sapi_add_header_ex(ZEND_STRL("Cache-Control: no-cache, no-store, must-revalidate, max-age=0"), 1, 1); PUTS("Internal error. Please review log file for errors."); + zend_string_release_ex(_GET_str, 0); fpm_scoreboard_free_copy(scoreboard_p); return 1; } @@ -204,6 +206,7 @@ int fpm_status_handle_request(void) /* {{{ */ /* handle HEAD */ if (SG(request_info).headers_only) { + zend_string_release_ex(_GET_str, 0); fpm_scoreboard_free_copy(scoreboard_p); return 1; } diff --git a/sapi/fpm/tests/status-head.phpt b/sapi/fpm/tests/status-head.phpt new file mode 100644 index 000000000000..a21fb7a7f1f8 --- /dev/null +++ b/sapi/fpm/tests/status-head.phpt @@ -0,0 +1,40 @@ +--TEST-- +FPM: Status HEAD request returns headers without body +--SKIPIF-- + +--FILE-- +start(); +$tester->expectLogStartNotices(); +$tester->request()->expectEmptyBody(); + +$response = $tester->request(uri: '/status', method: 'HEAD'); +$response->expectEmptyBody(); + +$tester->terminate(); +$tester->expectLogTerminatingNotices(); +$tester->close(); + +?> +Done +--EXPECT-- +Done +--CLEAN-- +