[packages/php/PHP_8_1] opcache: mediate include_once/require_once under revalidate_path

[arekm]

commit 0a38f712d5626f6de51a6d91e447c1fe23ac2685
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Sep 2 00:23:42 2026 +0200

    opcache: mediate include_once/require_once under revalidate_path
    
    Those forms skipped the open(), so on a shared SHM cache one uid could run
    another uid's cached script past the LSM profile and open_basedir.

 opcache-revalidate-path-once.patch | 16 ++++++++++++++++
 php.spec                           |  4 +++-
 2 files changed, 19 insertions(+), 1 deletion(-)
---
diff --git a/php.spec b/php.spec
index e82950c..dd32e63 100644
--- a/php.spec
+++ b/php.spec
@@ -149,7 +149,7 @@ Summary(ru.UTF-8):	PHP - язык препроцессирования HTML-фа
 Summary(uk.UTF-8):	PHP - мова препроцесування HTML-файлів, виконувана на сервері
 Name:		%{orgname}%{php_suffix}
 Version:	8.1.34
-Release:	5
+Release:	6
 Epoch:		4
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
@@ -206,6 +206,7 @@ Patch67:	mysql-lib-ver-mismatch.patch
 Patch68:	php-mysql-ssl-context.patch
 Patch71:	libdb-info.patch
 Patch72:	php-xml-attr-entity.patch
+Patch73:	opcache-revalidate-path-once.patch
 URL:		https://www.php.net/
 %{?with_pdo_firebird:%{!?with_interbase_inst:BuildRequires:	Firebird-devel >= 1.0.2.908-2}}
 %{?with_pspell:BuildRequires:	aspell-devel >= 2:0.50.0}
@@ -1905,6 +1906,7 @@ cp -p php.ini-production php.ini
 #%%patch -P68 -p1 DROP or update to 7.0 APIs
 %patch -P71 -p1 -b .libdb-info
 %patch -P72 -p1 -b .attr-entity
+%patch -P73 -p1
 
 sed -E -i -e '1s,#!\s*/usr/bin/env\s+(.*),#!%{__bindir}\1,' \
       ext/ext_skel.php \
diff --git a/opcache-revalidate-path-once.patch b/opcache-revalidate-path-once.patch
new file mode 100644
index 0000000..6e75f8f
--- /dev/null
+++ b/opcache-revalidate-path-once.patch
@@ -0,0 +1,16 @@
+Make opcache.revalidate_path cover include_once/require_once too: they take a ready
+cached script from persistent_zend_resolve_path() and skip the open(), so on an SHM
+cache shared by several uids one account can run another's cached script past the
+LSM profile or open_basedir. No-op with the default revalidate_path=0.
+
+--- php/ext/opcache/ZendAccelerator.c.orig
++++ php/ext/opcache/ZendAccelerator.c
+@@ -2574,7 +2574,7 @@
+ 			if (resolved_path) {
+ 				/* lookup by real path */
+ 				zend_accel_hash_entry *bucket = zend_accel_hash_find_entry(&ZCSG(hash), resolved_path);
+-				if (bucket) {
++				if (bucket && !ZCG(accel_directives).revalidate_path) {
+ 					zend_persistent_script *persistent_script = (zend_persistent_script *)bucket->data;
+ 					if (!persistent_script->corrupted) {
+ 						if (key) {
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/0a38f712d5626f6de51a6d91e447c1fe23ac2685