Skip to content

Crash on out of memory #24584

Closed as not planned
Closed as not planned

Description

@DemiMarie

Description

php2shell was a consequence of PHP trying to recover from out of memory. An alternative approach, which is likely much simpler to maintain, is to not even attempt to recover. Instead, treat OOM as fatal and call _exit or abort, terminating the process. The supervisor can then restart it.

Activity

  1. Krishmal2004 commented on Oct 23, 2026

    @Krishmal2004

    @DemiMarie can you assign this issue

  2. DemiMarie commented on Oct 23, 2026

    @DemiMarie
    Author

    @Krishmal2004 assign to whom? I’m a security researcher, not a PHP core developer.

  3. ndossche commented on Oct 23, 2026

    @ndossche
    Member

    php2shell was a consequence of PHP trying to recover from out of memory.

    This is a bit of an oversimplification.

    An alternative approach, which is likely much simpler to maintain, is to not even attempt to recover. Instead, treat OOM as fatal and call _exit or abort, terminating the process.

    This is not acceptable for environments like ZTS. The current behaviour was chosen deliberately.

  4. krustfurt commented on Oct 27, 2026

    @krustfurt

    The current behaviour was chosen deliberately.

    I thought when PHP exceeds memory defined in php.ini's memory_limit it exit with error by default?

    If this is not default behavior why PHP doesn't exit with error when OOM happens?

  5. n0099 commented on Oct 27, 2026

    @n0099

    When running as a thread with ZTS version: https://stackoverflow.com/questions/58918146/why-php-zts-is-disabled-by-default, you cannot simply exit the whole process as you are just one of many threads in this process, and others may have no relationship to PHP.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions