[GIT-PULLS] [php-src] PR #22986: Fix GH-19320: Prevent FPM UID and GID overflow

[email protected] (prateekbhujel) Sat, 1 Aug 2026 08:18:49 +0000
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22986
Author: prateekbhujel

FPM parses numeric `user`, `group`, `listen.owner`, and `listen.group` values with `strtoul()`, but stores them in signed `int` fields. That can silently change an ID before it reaches `setuid()`, `setgid()`, or `chown()`.

This stores the values in `uid_t`/`gid_t` and rejects IDs that the platform types cannot represent during config validation. It also rejects the all-bits-one value used by `chown()` as its no-change sentinel.

I added coverage for all four numeric directives and ran the full FPM test suite.

Fixes GH-19320