Repository navigation
Conversation
GromNaN
force-pushed
the
fix/cli-argv-atexit
branch
from
November 5, 2026 11:49
eb4f4df to
f8bbbfe
Compare
GromNaN
force-pushed
the
fix/cli-argv-atexit
branch
from
November 5, 2026 12:10
f8bbbfe to
034b4a5
Compare
GromNaN
force-pushed
the
fix/cli-argv-atexit
branch
2 times, most recently
from
November 5, 2026 12:31
6f973c3 to
33d46b3
Compare
cleanup_ps_args() frees the argv copy installed by save_ps_args() in _NSGetArgv() and restores environ only. Handlers registered with atexit() run after it, so any of them that reads the process arguments gets freed memory. On macOS this crashes ext-mongodb shutdown, because Apple's Cyrus SASL logs through ASL and asl_open() reads _NSGetArgv(). Restore the original argv pointer before freeing the copy, as is already done for environ. Add a zend_test hook and a test for the atexit() handler case.
GromNaN
force-pushed
the
fix/cli-argv-atexit
branch
from
November 5, 2026 14:33
33d46b3 to
c3a24e5
Compare
GromNaN
marked this pull request as ready for review
November 5, 2026 14:42
TimWolla
removed their request for review
November 9, 2026 07:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ext-mongodb2.5.x crashes on macOS at process shutdown, in about half of the CLI runs, with this stack:The extension calls
sasl_client_done()from anatexit()handler. On macOS, Apple's Cyrus SASL logs through ASL, andasl_open()reads the process arguments through_NSGetArgv().The root cause is in PHP.
save_ps_args()installs a copy of argv in_NSGetArgv(), andcleanup_ps_args()frees that copy just beforeexit()without restoring the pointer. Anyatexit()handler that reads_NSGetArgv()after that point reads freed memory. This is not specific toext-mongodb: another library that logs through ASL from anatexit()handler can hit the same crash. See mongodb/mongo-php-driver#2213, where the extension works around it.Restore the original argv pointer before freeing the copy, as is already done for
environ.The test adds a
zend_testhook that registers anatexit()handler reading_NSGetArgv(), and checks that it no longer sees the freed copy and thatargv[0]is readable.ZEND_DONT_UNLOAD_MODULES=1keeps the extension loaded so the handler runs at process exit, and the test also covers a process title set withcli_set_process_title().Verified on PHP 8.4 with
zend_testbuilt statically: the test passes with the fix, fails without it, and passes withrun-tests.php --repeat 2.This targets PHP 8.4, the oldest branch in active support.