[GIT-PULLS] [php-src] PR #22762: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
[email protected] (iliaal) Thu, 16 Jul 2026 13:15:47 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22762
Author: iliaal
`php_filter_encode_url()` builds a 256-byte table marking which bytes need percent-encoding, but initializes it with `memset(tmp, 1, sizeof(tmp) - 1)`, so tmp[255] is never written. Whether 0xFF gets encoded then depends on stack garbage.
On PHP-8.4 it currently reads as unencoded, which is visible from userland:
filter_var("\xFE\xFF\x00A", FILTER_SANITIZE_ENCODED); // "%FE\xFF%00A", 0xFE encoded, 0xFF not
valgrind on the unpatched build:
Conditional jump or move depends on uninitialised value(s)
at php_filter_encode_url (sanitizing_filters.c:83)
by php_filter_encoded (sanitizing_filters.c:219)
Uninitialised value was created by a stack allocation
Present on 8.3 through master, targeting 8.4 as the lowest actively supported branch.