[php-src] master: Merge branch 'PHP-8.5'

Author: David Carlier (devnexen)
Date: 2026-07-18T23:09:53+01:00

Commit: https://github.com/php/php-src/commit/ec391cf8cb6895d481fbc5c1b5c9bbe8afdff825
Raw diff: https://github.com/php/php-src/commit/ec391cf8cb6895d481fbc5c1b5c9bbe8afdff825.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/sockets: memory related issues fix.

Changed paths:
  M  ext/sockets/conversions.c
  M  ext/sockets/multicast.c
  M  ext/sockets/sockets.c


Diff:

diff --git a/ext/sockets/conversions.c b/ext/sockets/conversions.c
index abf9004f522d..9b36e087e071 100644
--- a/ext/sockets/conversions.c
+++ b/ext/sockets/conversions.c
@@ -1218,6 +1218,7 @@ static void to_zval_read_iov(const char *msghdr_c, zval *zv, res_context *ctx)
 	if (iovlen > UINT_MAX) {
 		do_to_zval_err(ctx, "unexpectedly large value for iov_len: %lu",
 				(unsigned long)iovlen);
+		return;
 	}
 	array_init_size(zv, (uint32_t)iovlen);
 
diff --git a/ext/sockets/multicast.c b/ext/sockets/multicast.c
index 88fcf21278d2..9ff7eb0b136a 100644
--- a/ext/sockets/multicast.c
+++ b/ext/sockets/multicast.c
@@ -652,7 +652,7 @@ zend_result php_if_index_to_addr4(unsigned if_index, php_socket *php_sock, struc
 retry:
 	retval = GetIpAddrTable(addr_table, &size, 0);
 	if (retval == ERROR_INSUFFICIENT_BUFFER) {
-		erealloc(addr_table, size);
+		addr_table = erealloc(addr_table, size);
 		goto retry;
 	}
 	if (retval != NO_ERROR) {
@@ -694,7 +694,7 @@ zend_result php_add4_to_if_index(struct in_addr *addr, php_socket *php_sock, uns
 retry:
 	retval = GetIpAddrTable(addr_table, &size, 0);
 	if (retval == ERROR_INSUFFICIENT_BUFFER) {
-		erealloc(addr_table, size);
+		addr_table = erealloc(addr_table, size);
 		goto retry;
 	}
 	if (retval != NO_ERROR) {
diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c
index 9c9c86ba6733..c4c6f224dcfa 100644
--- a/ext/sockets/sockets.c
+++ b/ext/sockets/sockets.c
@@ -2032,6 +2032,7 @@ PHP_FUNCTION(socket_get_option)
 #endif
 
 	optlen = sizeof(other_val);
+	other_val = 0;
 
 	if (getsockopt(php_sock->bsd_socket, level, optname, (char*)&other_val, &optlen) != 0) {
 		PHP_SOCKET_ERROR(php_sock, "Unable to retrieve socket option", errno);
@@ -2057,6 +2058,10 @@ PHP_FUNCTION(socket_set_option)
 	DWORD						timeout;
 #else
 	struct					timeval tv;
+#endif
+#ifdef SO_ATTACH_REUSEPORT_CBPF
+	struct sock_filter cbpf[8] = {0};
+	struct sock_fprog bpfprog;
 #endif
 	zend_long					level, optname;
 	void 					*opt_ptr;
@@ -2345,8 +2350,6 @@ PHP_FUNCTION(socket_set_option)
 				optname = SO_DETACH_BPF;
 			} else {
 				uint32_t k = (uint32_t)cbpf_val;
-				static struct sock_filter cbpf[8] = {0};
-				static struct sock_fprog bpfprog;
 
 				switch (k) {
 					case SKF_AD_CPU:
@@ -2645,6 +2648,7 @@ PHP_FUNCTION(socket_import_stream)
 	retsock = Z_SOCKET_P(return_value);
 
 	if (!socket_import_file_descriptor(socket, retsock)) {
+		retsock->bsd_socket = -1;
 		zval_ptr_dtor(return_value);
 		RETURN_FALSE;
 	}