[forgeblueai]

Purpose

Extend the independently verified Base64 OOM fix candidate from #5 toward official submission (tracked in #6).

Changes

• Build patched ZTS PHP 8.4.27 and 8.5.12 with SOAP, OpenSSL, and iconv enabled.
• Run six official upstream Base64 PHPT tests plus two local regression tests and one new offline native-caller integration PHPT.
• Check exact PHP source SHAs before applying the candidate patch.
• Check patch applicability to the current upstream PHP-8.4 branch (without conflating a clean apply with a passing build).
• Document PHP version support policy, upstream target, caller-contract limitations, and manual fork/submission path.

Gates

• Both ZTS builds succeed and report Thread Safety enabled
• Base64 PHPT and C consumer smoke tests pass on both
• Patch cleanly applies to current PHP-8.4
• Inspect logs before merging; a green run does not establish full API compatibility

References: php/php-src#24492, #24548, #24596. No new vulnerability claim; no upstream PR created yet.

[forgeblueai]

ZTS upstream-readiness evidence — verified 2026-10-23

Final successful workflow: https://github.com/forgeblueai/php-core-lab/actions/runs/39999223589 (head 2a19fbe4a858f9615305bbc3fbb97a9514445389).

Gate	Result
PHP 8.4.27 patched ZTS build	PASS; Thread Safety enabled
PHP 8.5.12 patched ZTS build	PASS; Thread Safety enabled
PHP 8.4.27 Base64 / C callers / OOM PHPT	9/9 pass
PHP 8.5.12 Base64 / C callers / OOM PHPT	9/9 pass
OpenSSL, iconv and SOAP compiled and loaded in both	PASS
Patch applies to current upstream PHP-8.4 (SHA b0c8e27b27b5c7676586b126a4e5c2982a46d63c)	PASS

Diagnosis of previous red run

The first PHP 8.5.12 run failed in the test fixture before executing any of its assertions: SoapClient::__doRequest() has an additional optional ?string $uriParserClass = null sixth parameter in PHP 8.5, which our five-parameter override omitted. The captured PHPT diff proved the signature error. The fixture now declares this sixth optional parameter, which is also compatible with the PHP 8.4 parent method. Both versions pass all nine tests after the fix.

What this does and does not establish

• Provides initial ZTS and representative internal C-helper caller smoke coverage, plus earlier NTS/ASan evidence from research: verify PHP Base64 fallible-allocation patch before/after #5.
• It does not exhaustively verify all extension call sites, all CPU-dispatch variants, cross-architecture behavior, or full PHP suite.
• No upstream php-src PR has been created. A fork of php/php-src under forgeblueai is still required.
• Per current PHP support policy, the lowest bugfix-maintained target is PHP-8.4 (8.2 and 8.3 are security-only).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T18:02:36.956010Z	2a19fbe	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.