From db4623948a16400e2cc502d9a3e99d97fd3f6449 Mon Sep 17 00:00:00 2001 From: Josh Date: Tue, 3 Nov 2026 12:29:36 -0500 Subject: [PATCH] Fix unchecked brigade flatten errors in apache2handler php_apache_sapi_read_post() checks ap_get_brigade() errors but ignores the return value of apr_brigade_flatten(). If a bucket read fails during flattening, APR returns before updating the supplied length. The callback then counts the requested length as successfully read, potentially reporting bytes that were not written into the destination buffer. Apache's core input filter normally reads socket buckets and propagates errors through ap_get_brigade(), so ordinary network failures are already handled. This change defensively handles any bucket-read failure occurring during the subsequent flatten operation; no such failure has been demonstrated with the standard input-filter chain. Check the flatten result after cleaning up the brigade and return zero on failure, matching the existing handling of ap_get_brigade() errors. Successful reads are unchanged. Assisted-by: Copilot:gpt-6.1-sol --- sapi/apache2handler/sapi_apache2.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c index 1d85a92ebf4d..58385bc43940 100644 --- a/sapi/apache2handler/sapi_apache2.c +++ b/sapi/apache2handler/sapi_apache2.c @@ -195,8 +195,13 @@ php_apache_sapi_read_post(char *buf, size_t count_bytes) */ while ((status = ap_get_brigade(r->input_filters, brigade, AP_MODE_READBYTES, APR_BLOCK_READ, len)) == APR_SUCCESS) { - apr_brigade_flatten(brigade, buf, &len); + status = apr_brigade_flatten(brigade, buf, &len); apr_brigade_cleanup(brigade); + + if (status != APR_SUCCESS) { + return 0; + } + tlen += len; if (tlen == count_bytes || !len) { break;