[GIT-PULLS] [php-src] PR #22986: Fix GH-19320: Prevent FPM UID and GID overflow
[email protected] (prateekbhujel) Sat, 1 Aug 2026 08:18:49 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22986 Author: prateekbhujel FPM parses numeric `user`, `group`, `listen.owner`, and `listen.group` values with `strtoul()`, but stores them in signed `int` fields. That can silently change an ID before it reaches `setuid()`, `setgid()`, or `chown()`. This stores the values in `uid_t`/`gid_t` and rejects IDs that the platform types cannot represent during config validation. It also rejects the all-bits-one value used by `chown()` as its no-change sentinel. I added coverage for all four numeric directives and ran the full FPM test suite. Fixes GH-19320