Kangwa Mukonda mukondakangwa1@gmail.com
11:44 AM (5 minutes ago)
to internals
Hello PHP internals,
I found a reproducible out-of-tree build-system issue in the signed PHP
8.4.27 release. I am using the internals list because bugs.php.net no
longer accepts reports and GitHub is unavailable in this environment.
Summary
When configure is run out of tree with the authenticated PHP source mounted
read-only, it attempts to create main/php_config.h.in.tmp inside the source
tree. The write fails with "Read-only file system", but configure
continues, creates the build Makefile, prints its success banner, and exits
with status 0.
Source
PHP 8.4.27 official tar.xz
SHA-256: dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0
Signature verified with PHP 8.4 release-manager key
9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6.
The archive also matched Debian's independently signed php8.4
8.4.27-1~deb13u1 source byte-for-byte.
Environment
Kali rolling, x86_64
Linux 7.1.5+kali-amd64
GCC 15.3.0
GNU Make 4.4.1
Bubblewrap with a new network namespace; system and source trees read-only;
out-of-tree build directory writable.
Minimal reproduction
- Extract php-8.4.27.tar.xz.
- Create a separate writable build directory.
- Make or mount the source tree read-only.
- From the build directory run:
/path/to/php-8.4.27/configure --disable-all --enable-cli --disable-cgi
--disable-phpdbg --without-pear
Observed result
configure exit status: 0
Makefile created: yes
success banner printed: yes
read-only write failure count: 1
Relevant output:
configure: creating Makefile
configure: patching main/php_config.h.in
/path/to/php-8.4.27/configure: line 93943:
/path/to/php-8.4.27/main/php_config.h.in.tmp: Read-only file system
Thank you for using PHP.
Expected result
For a supported out-of-tree configuration, configure should not modify the
source tree. If modification is unavoidable, the failed write should be
fatal and configure should return a nonzero status instead of reporting
success.
Additional result
The generated build subsequently compiled successfully, so this report
concerns the unexpected source-tree write and swallowed failure rather than
a compilation failure.
Evidence
Full configure log SHA-256:
860f4189fb5c1b9b3a3aae43ff8ad498cbab6bbd4582d7c9e6a40beb71fe11f5
No exploit was developed or executed. I can provide the complete configure
log and reproduction receipt if useful.
Regards,
Mukonda Kangwa
Email: mukondakangwa1@gmail.com
Phone / Airtel: +260 773 695 472
Lusaka, Zambia