enhance memory safety

Author: zeriyoshi

ext/date/php_date.c

@@ -29,6 +29,7 @@
 #include "ext/standard/info.h"
 #include "ext/standard/php_filestat.h"
 #include "php_signal.h"
+#include "ext/user_cache/php_user_cache.h"
 #include "php_ticks.h"
 #include "zend_exceptions.h"
 #include "zend_fibers.h"
@@ -271,8 +272,12 @@ PHP_FUNCTION(pcntl_fork)
 
 	ZEND_PARSE_PARAMETERS_NONE();
 
+	php_ucache_fork_prepare();
+
 	id = fork();
 	if (id == -1) {
+		php_ucache_fork_cancel();
+
 		PCNTL_G(last_error) = errno;
 		switch (errno) {
 			case EAGAIN:
@@ -1586,9 +1591,13 @@ PHP_FUNCTION(pcntl_rfork)
 	}
 #endif
 
+	php_ucache_fork_prepare();
+
 	pid = rfork(flags);
 
 	if (pid == -1) {
+		php_ucache_fork_cancel();
+
 		PCNTL_G(last_error) = errno;
 		switch (errno) {
 			case EAGAIN:
@@ -1626,9 +1635,13 @@ PHP_FUNCTION(pcntl_forkx)
 		RETURN_THROWS();
 	}
 
+	php_ucache_fork_prepare();
+
 	pid = forkx(flags);
 
 	if (pid == -1) {
+		php_ucache_fork_cancel();
+
 		PCNTL_G(last_error) = errno;
 		switch (errno) {
 			case EAGAIN:

ext/pcntl/pcntl.c

@@ -1602,10 +1602,15 @@ static bool spl_array_object_copy_ucache_state(
 
 static bool spl_array_object_serialize_ucache_state(zval *state, const zval *object)
 {
+	const spl_array_object *intern = Z_SPLARRAY_P(object);
 	zval *storage;
 
 	ZVAL_UNDEF(state);
 
+	if (!(intern->ar_flags & SPL_ARRAY_IS_SELF) && Z_TYPE(intern->array) != IS_ARRAY) {
+		return false;
+	}
+
 	spl_array_object_serialize_state((zval *) object, state, /* with_members */ false);
 
 	if (EG(exception) || Z_TYPE_P(state) != IS_ARRAY) {
@@ -1628,12 +1633,55 @@ static bool spl_array_object_serialize_ucache_state(zval *state, const zval *obj
 
 static PHP_UCACHE_HOT bool spl_array_object_unserialize_ucache_state(zval *object, zval *state)
 {
+	spl_array_object *intern;
+	zend_class_entry *ce_get_iterator = NULL;
+	zend_long flags;
+	zval *flags_zv, *storage_zv, *iterator_class_zv;
+
 	if (Z_TYPE_P(state) != IS_ARRAY) {
 		return false;
 	}
 
-	return spl_array_object_unserialize_state(object, Z_ARRVAL_P(state), /* with_members */ false)
-		&& !EG(exception);
+	flags_zv          = zend_hash_index_find(Z_ARRVAL_P(state), 0);
+	storage_zv        = zend_hash_index_find(Z_ARRVAL_P(state), 1);
+	iterator_class_zv = zend_hash_index_find(Z_ARRVAL_P(state), 2);
+
+	if (flags_zv == NULL || storage_zv == NULL || Z_TYPE_P(flags_zv) != IS_LONG) {
+		return false;
+	}
+
+	flags = Z_LVAL_P(flags_zv) & SPL_ARRAY_CLONE_MASK;
+	if (!(flags & SPL_ARRAY_IS_SELF) && Z_TYPE_P(storage_zv) != IS_ARRAY) {
+		return false;
+	}
+
+	if (iterator_class_zv != NULL && Z_TYPE_P(iterator_class_zv) != IS_NULL) {
+		if (Z_TYPE_P(iterator_class_zv) != IS_STRING) {
+			return false;
+		}
+
+		ce_get_iterator = zend_lookup_class(Z_STR_P(iterator_class_zv));
+		if (ce_get_iterator == NULL || EG(exception) || !instanceof_function(ce_get_iterator, spl_ce_ArrayIterator)) {
+			return false;
+		}
+	}
+
+	intern = Z_SPLARRAY_P(object);
+	intern->ar_flags = (intern->ar_flags & ~SPL_ARRAY_CLONE_MASK) | flags;
+
+	if (ce_get_iterator != NULL) {
+		intern->ce_get_iterator = ce_get_iterator;
+	}
+
+	if (flags & SPL_ARRAY_IS_SELF) {
+		zval_ptr_dtor(&intern->array);
+
+		ZVAL_UNDEF(&intern->array);
+	} else {
+		spl_array_set_array(object, intern, storage_zv, 0L, true);
+	}
+
+	return !EG(exception);
 }
 
 static const php_ucache_safe_direct_handlers spl_array_ucache_handlers = {

ext/spl/spl_array.c

@@ -109,6 +109,10 @@ ZEND_API php_ucache_partition *php_ucache_partition_create(const char *name);
 ZEND_API void php_ucache_partition_set_max_procs(php_ucache_partition *partition, uint32_t max_procs);
 ZEND_API bool php_ucache_partition_startup_storage(php_ucache_partition *partition);
 ZEND_API void php_ucache_partition_activate(php_ucache_partition *partition);
+ZEND_API void php_ucache_partition_detach_all_except(php_ucache_partition *keep);
+ZEND_API void php_ucache_fork_prepare(void);
+ZEND_API void php_ucache_fork_cancel(void);
+ZEND_API void php_ucache_child_init(void);
 ZEND_API void php_ucache_activate_boundary_partition_by_id(
 		const char *sapi_prefix,
 		const char *boundary,

ext/user_cache/php_user_cache.h

@@ -0,0 +1,83 @@
+--TEST--
+FPM: a worker maps only its own pool's partition segment
+--SKIPIF--
+<?php
+include __DIR__ . '/skipif.inc';
+if (!is_readable('/proc/self/maps')) {
+    die('skip requires /proc/self/maps');
+}
+?>
+--FILE--
+<?php
+
+require_once __DIR__ . '/tester.inc';
+
+$cfg = <<<EOT
+[global]
+error_log = {{FILE:LOG}}
+[alpha]
+listen = {{ADDR[alpha]}}
+pm = static
+pm.max_children = 1
+pm.max_requests = 0
+catch_workers_output = yes
+php_admin_value[user_cache.shm_size] = 24M
+[beta]
+listen = {{ADDR[beta]}}
+pm = static
+pm.max_children = 1
+pm.max_requests = 0
+catch_workers_output = yes
+php_admin_value[user_cache.shm_size] = 20M
+EOT;
+
+$code = <<<'PHP'
+<?php
+$pool = $_GET['pool'];
+$cache = UserCache\Cache::getPool('default');
+$cache->store('probe', $pool);
+$own = UserCache\Cache::getStatus()->getSharedMemorySize();
+$sizes = [24 * 1024 * 1024 => 0, 20 * 1024 * 1024 => 0];
+foreach (file('/proc/self/maps') as $line) {
+    if (!preg_match('~^([0-9a-f]+)-([0-9a-f]+) (\S+) ~', $line, $m) || $m[3][3] !== 's') {
+        continue;
+    }
+    $len = hexdec($m[2]) - hexdec($m[1]);
+    if (isset($sizes[$len])) {
+        $sizes[$len]++;
+    }
+}
+printf("%s own=%dM alpha-sized=%d beta-sized=%d value=%s\n", $pool, $own >> 20, $sizes[24 * 1024 * 1024], $sizes[20 * 1024 * 1024], $cache->fetch('probe'));
+PHP;
+
+$tester = new FPM\Tester($cfg, $code);
+$tester->start(iniEntries: [
+    'opcache.file_update_protection' => '0',
+]);
+$tester->expectLogStartNotices();
+
+foreach (['alpha', 'beta'] as $pool) {
+    $response = $tester->request(query: 'pool=' . $pool, address: '{{ADDR[' . $pool . ']}}');
+    echo trim((string) $response->getBody()), "\n";
+}
+
+$tester->terminate();
+$tester->expectLogTerminatingNotices();
+$tester->close();
+
+/* Release builds do not collect cycles at shutdown. */
+unset($tester);
+gc_collect_cycles();
+
+echo "Done\n";
+
+?>
+--EXPECT--
+alpha own=24M alpha-sized=1 beta-sized=0 value=alpha
+beta own=20M alpha-sized=0 beta-sized=1 value=beta
+Done
+--CLEAN--
+<?php
+require_once __DIR__ . '/tester.inc';
+FPM\Tester::clean();
+?>

ext/user_cache/tests/fpm/user_cache_fpm_pool_detach.phpt

@@ -166,6 +166,25 @@ try {
     echo $e->getMessage(), "\n";
 }
 var_dump($cache->fetch('anonymous-start', 'not stored'));
+
+/* Cursors advanced by an unserialize()d or weekday-relative interval carry that interval's stale relative fields and still restore. */
+echo "\ncursor relative state:\n";
+$unserializedInterval = unserialize(serialize(new DateInterval('P1D')));
+$fromUnserialized = new DatePeriod(new DateTimeImmutable('2026-01-01'), $unserializedInterval, 2);
+foreach ($fromUnserialized as $unused) {
+}
+$cache->store('cursor-unserialized-interval', $fromUnserialized);
+$u = $cache->fetch('cursor-unserialized-interval', 'unrestorable');
+var_dump($u instanceof DatePeriod && serialize($u) === serialize($fromUnserialized));
+var_dump(period_dates($u) === ['2026-01-01', '2026-01-02', '2026-01-03']);
+
+$byWeekday = new DatePeriod(new DateTimeImmutable('2026-01-01'), DateInterval::createFromDateString('next monday'), 2);
+foreach ($byWeekday as $unused) {
+}
+$cache->store('cursor-weekday-interval', $byWeekday);
+$w = $cache->fetch('cursor-weekday-interval', 'unrestorable');
+var_dump($w instanceof DatePeriod && serialize($w) === serialize($byWeekday));
+var_dump(period_dates($w) === period_dates($byWeekday), period_dates($w));
 ?>
 --EXPECT--
 bool(true)
@@ -197,3 +216,17 @@ string(3) "PST"
 bool(true)
 Serialization of 'DateTimeImmutable@anonymous' is not allowed
 string(10) "not stored"
+
+cursor relative state:
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+array(3) {
+  [0]=>
+  string(10) "2026-01-01"
+  [1]=>
+  string(10) "2026-01-05"
+  [2]=>
+  string(10) "2026-01-12"
+}

ext/user_cache/tests/user_cache_dateperiod_safe_direct.phpt

@@ -0,0 +1,75 @@
+--TEST--
+UserCache\Cache: a DatePeriod whose start class the fetching process cannot load, or can only load as abstract, is unrestorable
+--EXTENSIONS--
+pcntl
+--INI--
+user_cache.enable=1
+user_cache.enable_cli=1
+user_cache.shm_size=16M
+date.timezone=UTC
+--FILE--
+<?php
+/* The storing child declares concrete start classes; the fetching parent sees one of them only as abstract, the other not at all. */
+$cache = UserCache\Cache::getPool('dateperiod-start-class');
+$cache->clear();
+
+spl_autoload_register(static function (string $class): void {
+    echo "autoload: $class\n";
+    if ($class === 'UserCacheAbstractLaterStart') {
+        eval('abstract class UserCacheAbstractLaterStart extends DateTimeImmutable {}');
+    }
+});
+
+$pid = pcntl_fork();
+if ($pid < 0) {
+    die("fork failed\n");
+}
+if ($pid === 0) {
+    eval('class UserCacheAbstractLaterStart extends DateTimeImmutable {}');
+    eval('class UserCacheMissingLaterStart extends DateTimeImmutable {}');
+    $stored = $cache->store('abstract-start', new DatePeriod(new UserCacheAbstractLaterStart('2026-01-01'), new DateInterval('P1D'), 1))
+        && $cache->store('missing-start', new DatePeriod(new UserCacheMissingLaterStart('2026-01-01'), new DateInterval('P1D'), 1))
+        && $cache->store('plain-start', new DatePeriod(new DateTimeImmutable('2026-01-01'), new DateInterval('P1D'), 1));
+    exit($stored ? 0 : 1);
+}
+pcntl_waitpid($pid, $status);
+var_dump(pcntl_wexitstatus($status));
+
+echo "stored by child:\n";
+var_dump($cache->has('abstract-start'), $cache->has('missing-start'), $cache->has('plain-start'));
+
+echo "abstract start class:\n";
+var_dump($cache->fetch('abstract-start', 'unrestorable'));
+var_dump(class_exists('UserCacheAbstractLaterStart', false));
+
+echo "missing start class:\n";
+var_dump($cache->fetch('missing-start', 'unrestorable'));
+
+echo "plain start class:\n";
+$plain = $cache->fetch('plain-start', 'unrestorable');
+var_dump($plain instanceof DatePeriod);
+var_dump($plain->getStartDate()->format('Y-m-d'));
+
+echo "unrestorable entries are dropped:\n";
+var_dump($cache->has('abstract-start'), $cache->has('missing-start'), $cache->has('plain-start'));
+?>
+--EXPECT--
+int(0)
+stored by child:
+bool(true)
+bool(true)
+bool(true)
+abstract start class:
+autoload: UserCacheAbstractLaterStart
+string(12) "unrestorable"
+bool(true)
+missing start class:
+autoload: UserCacheMissingLaterStart
+string(12) "unrestorable"
+plain start class:
+bool(true)
+string(10) "2026-01-01"
+unrestorable entries are dropped:
+bool(false)
+bool(false)
+bool(true)