[forgeblueai]

Purpose

Experimental PHP Core patch candidate for php/php-src#24492, building on ForgeBlue’s verified Base64 reproduction and caller audit in #4.

Patch design

• Add PHP_BASE64_FALLIBLE as a new php_base64_encode_ex() flag used only by PHP_FUNCTION(base64_encode).
• Change the five generic/SIMD Base64 allocations to zend_string_safe_falloc(..., fallible); return NULL before touching a failed buffer.
• At the userland entry point, report RETURN_OOM() when allocation fails.
• Preserve the existing non-fallible helper contract for internal call sites that pass flags 0 or PHP_BASE64_NO_PADDING.

Validation gates (CI must verify, not assumed)

• Git apply succeeds on both pinned PHP 8.4.27 and 8.5.12.
• Same build before patch: 13MiB base64_encode() probe hits hard-limit exit 137 and misses shutdown.
• Same build after patch: probe enters Base64, exits 255 with soft-limit diagnostic, and runs shutdown.
• Other bounded OOM probes unchanged.
• Standalone OOM PHPT + Base64 correctness PHPT pass on both patched builds.
• Patched 8.5.12 ASan/UBSan build passes correctness + smoke tests.

The source patch and experimental code are published in ForgeBlue’s lab, not submitted to upstream yet. We will inspect logs and upstream PR overlap before an upstream PR. No new CVE or independent vulnerability claim.

[forgeblueai]

Verified PHP Core patch evidence — 2026-10-23

Final comprehensive run: https://github.com/forgeblueai/php-core-lab/actions/runs/39996126737

All three jobs passed on exact, verified upstream source SHAs.

Test	PHP 8.4.27	PHP 8.5.12
Unpatched base64_encode_13m	exit 137; hard-limit diagnostic; shutdown absent	same
Patched base64_encode_13m	exit 255; soft-limit diagnostic; shutdown present	same
Unrelated OOM probes	No change in recorded classifications	No change
PHPT after patch	8/8 pass (six official Base64 tests plus two new regressions)	8/8 pass

Additional patched 8.5.12 Clang ASan+UBSan build: 11/11 targeted PHPT pass (six official Base64 tests, one new correctness test, and four existing smoke tests). No sanitizer diagnostic in those test logs. OOM probe was not run under USE_ZEND_ALLOC=0; LeakSanitizer was disabled, and results cannot establish global memory safety.

Source patch: patches/base64-fallible.patch, modifying five Base64 allocator call sites and the PHP userland wrapper; exported C helper flags 0/1 keep their prior non-fallible allocation behavior.

Remaining upstream acceptance work: validate on the lowest applicable maintained bugfix branch, run broader standard/extension tests and ZTS build, review performance/cross-architecture SIMD dispatch, recheck for overlapping upstream PRs, and submit through a fork to php/php-src. This PR is to the ForgeBlue experiment repo, not PHP upstream. No new vulnerability claim is made.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T17:40:44.553450Z	e3e8875	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.