Reset serialization state before request input processing

Serialization and unserialization contexts are stored in module globals, but
their allocations belong to the current request heap. If a bailout skips the
normal context cleanup, those globals can retain pointers to memory that is
freed at request shutdown.

The next request can process input before module RINIT runs. In particular,
multipart upload-progress handling can invoke session serialization during
input parsing, before the existing RINIT reset. It may therefore observe the
previous request’s stale context and lock state. Resetting only in RINIT is
too late to protect this path.

Clear the serialization lock and both context structures at the beginning of
request startup, before input processing. This discards the bookkeeping without
following potentially invalid pointers or running destructors. Remove the
redundant reset from basic-module RINIT.

Add regression coverage that abandons serialize or unserialize state via a
bailout, then sends a multipart upload-progress request to the same worker.
Verify the follow-up request sees cleared state for locked and unlocked cases.

Validation: the regression passes with the startup reset alone and fails when
both resets are removed.

Author: jvoisin

Zend/tests/arginfo_zpp_mismatch.inc

@@ -10,6 +10,7 @@ function skipFunction($function): bool {
      || $function === 'exit'
      || $function === 'die'
      || $function === 'zend_trigger_bailout'
+     || $function === 'zend_test_serialization_bailout'
         /* intentionally violate invariants */
      || $function === 'zend_create_unterminated_string'
      || $function === 'zend_test_array_return'

ext/standard/basic_functions.c

@@ -390,10 +390,6 @@ PHP_RINIT_FUNCTION(basic) /* {{{ */
 {
 	memset(BG(strtok_table), 0, 256);
 
-	BG(serialize_lock) = 0;
-	memset(&BG(serialize), 0, sizeof(BG(serialize)));
-	memset(&BG(unserialize), 0, sizeof(BG(unserialize)));
-
 	BG(strtok_string) = NULL;
 	BG(strtok_last) = NULL;
 	BG(ctype_string) = NULL;

ext/standard/php_var.h

@@ -26,6 +26,9 @@ PHPAPI zend_result php_var_export_ex(zval *struc, int level, smart_str *buf);
 
 PHPAPI void php_debug_zval_dump(zval *struc, int level);
 
+/* Reset before request input processing, never during serialization. */
+PHPAPI void php_var_serialization_reset(void);
+
 typedef struct php_serialize_data *php_serialize_data_t;
 typedef struct php_unserialize_data *php_unserialize_data_t;
 

ext/standard/var.c

@@ -1406,6 +1406,14 @@ PHPAPI void php_var_serialize(smart_str *buf, zval *struc, php_serialize_data_t
 }
 /* }}} */
 
+PHPAPI void php_var_serialization_reset(void)
+{
+	/* A bailout can abandon contexts that the request heap will reclaim. */
+	BG(serialize_lock) = 0;
+	memset(&BG(serialize), 0, sizeof(BG(serialize)));
+	memset(&BG(unserialize), 0, sizeof(BG(unserialize)));
+}
+
 PHPAPI php_serialize_data_t php_var_serialize_init(void) {
 	struct php_serialize_data *d;
 	/* fprintf(stderr, "SERIALIZE_INIT      == lock: %u, level: %u\n", BG(serialize_lock), BG(serialize).level); */

ext/zend_test/test.c

@@ -21,6 +21,7 @@
 #include "php.h"
 #include "php_ini.h"
 #include "ext/standard/info.h"
+#include "ext/standard/php_var.h"
 #include "php_test.h"
 #include "observer.h"
 #include "fiber.h"
@@ -200,6 +201,38 @@ static ZEND_FUNCTION(zend_leak_bytes)
 	emalloc(leakbytes);
 }
 
+static ZEND_FUNCTION(zend_test_serialization_bailout)
+{
+	bool unserialize, locked;
+
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_BOOL(unserialize)
+		Z_PARAM_BOOL(locked)
+	ZEND_PARSE_PARAMETERS_END();
+
+	if (unserialize) {
+		(void) php_var_unserialize_init();
+	} else {
+		(void) php_var_serialize_init();
+	}
+	if (locked) {
+		BG(serialize_lock)++;
+	}
+	zend_bailout();
+}
+
+static ZEND_FUNCTION(zend_test_serialization_state)
+{
+	ZEND_PARSE_PARAMETERS_NONE();
+
+	array_init(return_value);
+	add_assoc_long(return_value, "lock", BG(serialize_lock));
+	add_assoc_long(return_value, "serialize_level", BG(serialize).level);
+	add_assoc_bool(return_value, "serialize_data", BG(serialize).data != NULL);
+	add_assoc_long(return_value, "unserialize_level", BG(unserialize).level);
+	add_assoc_bool(return_value, "unserialize_data", BG(unserialize).data != NULL);
+}
+
 /* Reallocate a block of old_size bytes to new_size bytes and return its block
  * size, along with the block size of a fresh allocation of new_size bytes. */
 static ZEND_FUNCTION(zend_test_erealloc_block_size)

ext/zend_test/test.stub.php

@@ -301,6 +301,10 @@ function zend_delref(mixed $variable): void {}
 
     function zend_test_erealloc_block_size(int $old_size, int $new_size): array {}
 
+    function zend_test_serialization_bailout(bool $unserialize, bool $locked): never {}
+
+    function zend_test_serialization_state(): array {}
+
 	function zend_bool(bool $param): bool {}
 	function zend_bool_or_null(bool|null $param): bool|null {}
 	function zend_bool_slow_zpp(bool $param): bool {}

ext/zend_test/test_arginfo.h

@@ -1854,6 +1854,8 @@ zend_result php_request_startup(void)
 {
 	zend_result retval = SUCCESS;
 
+	/* Input processing can use serialization before module RINIT. */
+	php_var_serialization_reset();
 	zend_interned_strings_activate();
 
 #ifdef HAVE_DTRACE