Kangwa Mukonda <[email protected]> 11:44 AM (5 minutes ago)
to internals Hello PHP internals, I found a reproducible out-of-tree build-system issue in the signed PHP 8.4.27 release. I am using the internals list because bugs.php.net no longer accepts reports and GitHub is unavailable in this environment. Summary When configure is run out of tree with the authenticated PHP source mounted read-only, it attempts to create main/php_config.h.in.tmp inside the source tree. The write fails with "Read-only file system", but configure continues, creates the build Makefile, prints its success banner, and exits with status 0. Source PHP 8.4.27 official tar.xz SHA-256: dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0 Signature verified with PHP 8.4 release-manager key 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6. The archive also matched Debian's independently signed php8.4 8.4.27-1~deb13u1 source byte-for-byte. Environment Kali rolling, x86_64 Linux 7.1.5+kali-amd64 GCC 15.3.0 GNU Make 4.4.1 Bubblewrap with a new network namespace; system and source trees read-only; out-of-tree build directory writable. Minimal reproduction 1. Extract php-8.4.27.tar.xz. 2. Create a separate writable build directory. 3. Make or mount the source tree read-only. 4. From the build directory run: /path/to/php-8.4.27/configure --disable-all --enable-cli --disable-cgi --disable-phpdbg --without-pear Observed result configure exit status: 0 Makefile created: yes success banner printed: yes read-only write failure count: 1 Relevant output: configure: creating Makefile configure: patching main/php_config.h.in /path/to/php-8.4.27/configure: line 93943: /path/to/php-8.4.27/main/php_config.h.in.tmp: Read-only file system Thank you for using PHP. Expected result For a supported out-of-tree configuration, configure should not modify the source tree. If modification is unavoidable, the failed write should be fatal and configure should return a nonzero status instead of reporting success. Additional result The generated build subsequently compiled successfully, so this report concerns the unexpected source-tree write and swallowed failure rather than a compilation failure. Evidence Full configure log SHA-256: 860f4189fb5c1b9b3a3aae43ff8ad498cbab6bbd4582d7c9e6a40beb71fe11f5 No exploit was developed or executed. I can provide the complete configure log and reproduction receipt if useful. Regards, Mukonda Kangwa Email: [email protected] Phone / Airtel: +260 773 695 472 Lusaka, Zambia
