[GIT-PULLS] [php-src] PR #22762: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

[email protected] (iliaal) Thu, 16 Jul 2026 13:15:47 +0000
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22762
Author: iliaal

`php_filter_encode_url()` builds a 256-byte table marking which bytes need percent-encoding, but initializes it with `memset(tmp, 1, sizeof(tmp) - 1)`, so tmp[255] is never written. Whether 0xFF gets encoded then depends on stack garbage.

On PHP-8.4 it currently reads as unencoded, which is visible from userland:

    filter_var("\xFE\xFF\x00A", FILTER_SANITIZE_ENCODED);  // "%FE\xFF%00A", 0xFE encoded, 0xFF not

valgrind on the unpatched build:

    Conditional jump or move depends on uninitialised value(s)
       at php_filter_encode_url (sanitizing_filters.c:83)
       by php_filter_encoded (sanitizing_filters.c:219)
     Uninitialised value was created by a stack allocation

Present on 8.3 through master, targeting 8.4 as the lowest actively supported branch.