[forgeblueai]

Context

Follow-up to #2 and upstream php/php-src#24492.

This adds a bounded observation of base64_encode() memory-exhaustion behavior, which upstream PR #24548 explicitly leaves out of scope due to its exported C helper's caller contracts.

What changed

• One bounded public-issue-linked base64_encode_growth test in a disposable CI process.
• Integrates the test into existing fixed-SHA debug OOM probes and cross-version comparison.
• Documents source-level call path, optimized vs generic implementations, and multiple C consumers that assume a valid result.
• No source modifications to php/php-src, no unpatched historical releases, no zero-day or exploit PoC.

Verification gates

• 8.5.12 and 8.4.27 debug builds, four PHPT smoke tests, and the new bounded probe complete.
• Comparison generator unit tests pass and report includes the new case with verified SHA.
• Inspect raw diagnostics + shutdown markers before classifying the observed behavior.
• Ensure no duplicate contribution to already open upstream #24548 or #24596.

We must not turn the exported C helper nullable without auditing every caller.

[forgeblueai]

Verified Base64 OOM allocation evidence

Source: GitHub Actions run #39993301060, downloaded oom-results.json for both pinned releases and inspected raw diagnostics. ASan smoke run succeeded separately.

PHP version	Input	Input-ready marker	Exit	Shutdown	Meaning
8.4.27	14 MiB	absent	255	executed	Soft OOM during input construction
8.4.27	13 MiB	present	137	not executed	Base64 result allocation reaches hard limit
8.5.12	14 MiB	absent	255	executed	Soft OOM during input construction
8.5.12	13 MiB	present	137	not executed	Base64 result allocation reaches hard limit

Exact hard-limit allocation request: 18,178,048 bytes (both versions). Hard limit: 33,554,432 bytes.

Comparison job passed and reported changed cases: [] for all seven cases, 14 rows. The first comparison failure was caused by a stale unit assertion for the old 10-row matrix; fixed by deriving expected row count from case and version counts.

Static inspection of pinned PHP 8.5.12 demonstrates Base64 C callers in password.c, iconv.c, soap/php_http.c, http_fopen_wrapper.c, and openssl_backend_common.c assume a non-NULL helper result. A direct global fallible allocation change without addressing callers would be unsafe.

The permanent report and compact evidence are now committed to docs/findings/.

Status: reproduced public GH-24492 behavior, not a new vulnerability; not yet a core bug fix. Do not submit duplicate upstream patch while #24548 and related work remain open.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T17:22:37.990263Z	1be4bdb	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.