Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

php/php-src

              master @ eaa6325
            

802

Fixes

100

CVEs

CRITICAL

Peak severity

15.2%

Coverage

Highlights

Memory Corruption: 177 prior fixes. Scrutinize any change in this area.

Zend: most-fixed (59 issues). Treat as high-risk during review.

604 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Argument Injection: Command execution can be achieved via query strings on CGI configurations on Windows due to best-fit character mapping and improper command line switch parsing. Developers must bypass getopt parsing entirely under CGI modes and enforce strict option-terminating validations.

Path Traversal: Attackers repeatedly bypass the open_basedir directory sandbox. The vulnerabilities stem from incomplete path prefix validation (failing to enforce directory separators during prefix match) and resolving virtual paths to empty strings or CWD. Rigid canonicalization and checking full directory path boundaries are required to enforce these boundaries.

Memory Corruption: Integer overflows during string manipulation and concatenation consistently yield massive heap and stack-based overflows within the Zend Virtual Machine. Implementing strict string size limit gates (ZSTR_MAX_LEN) and migrating to overflow-checked multiplication/allocation helpers is critical to maintaining memory bounds.