Skip to content

Commit fe88c67

Browse files
authored
Initialize SWOOLE_G(cli) to avoid reading uninitialized global under threaded SAPIs (#6107)
php_swoole_init_globals() initializes every module global except `cli`, relying on the storage being zero-initialized. That holds for the CLI and single-threaded embed SAPIs, but not for threaded/embedded SAPIs such as FrankenPHP: each worker thread's module globals are allocated per thread and are not guaranteed to be zeroed before the ctor runs, so `cli` reads an indeterminate value. There, sapi_module.name is the host SAPI's own name (e.g. "frankenphp"), so the cli/phpdbg/embed/micro check never sets `cli`. When the leftover value is non-zero, PHP_RINIT_FUNCTION(swoole) passes its `if (!SWOOLE_G(cli)) return` guard and runs the request path, which calls swoole_set_task_tmpdir() and dereferences the (uninitialized) per-thread buffer, segfaulting on the first request. Explicitly default `cli` to false so the guard is reliable regardless of SAPI.
1 parent 6015d3d commit fe88c67

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

ext-src/php_swoole.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,7 @@ static void php_swoole_init_globals(zend_swoole_globals *swoole_globals) {
384384
swoole_globals->blocking_threshold = 100000;
385385
swoole_globals->profile = false;
386386
swoole_globals->leak_detection = false;
387+
swoole_globals->cli = false;
387388

388389
if (strcmp("cli", sapi_module.name) == 0 || strcmp("phpdbg", sapi_module.name) == 0 ||
389390
strcmp("embed", sapi_module.name) == 0 || strcmp("micro", sapi_module.name) == 0) {

0 commit comments

Comments
 (0)