Repository navigation
applying PHP-8.1-CVE-2026-109618-109619 triggers regeneration of Zend files #24649
Closed as not planned
Description
Description
Working on the the MacPorts backports of php2shell, I/we ran into the following problem:
When applying the patch, the zend_vm_gen.php is triggered by 9b816d8 leading to a build failure due to the files not being regenerated correctly.
For a detailed description, analysis and remidiation see macports/macports-ports#35882 .
The workaround is to add this to the patch :
--- a/Zend/zend_vm_gen.php 2026-10-23 13:30:15
+++ b/Zend/zend_vm_gen.php 2026-10-23 13:31:21
@@ -1,5 +1,6 @@
#!/usr/bin/env php
<?php
+exit ;
/*
+----------------------------------------------------------------------+
| Zend Engine |
PHP Version
PHP 8.1.34 (cli) (built: Oct 22 2026 13:48:02) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.34, Copyright (c) Zend Technologies
with Zend OPcache v8.1.34, Copyright (c), by Zend Technologies
Operating System
No response
Activity
iluuu1994 commentedon Oct 24, 2026
Hi. In what way are the files not being generated correctly? I tried the
PHP-8.1branch and was able to runzend_vm_gen.phpboth pre- and post-patch with both PHP 8.4 and the built PHP 8.1 binary, without deviating from the committed, generated file.ndossche commentedon Oct 24, 2026
The problem is that when they run PHP 8.5 on PHP-8.1's
zend_vm_gen.phpthat they get the constant naming conflict that breaks the generated VM code. To fix that, that would require backporting d3ef806Alternatively, we just tell them to always use the php version corresponding to the branch to execute
zend_vm_gen.php, rather than the latest oneiluuu1994 commentedon Oct 24, 2026
Ah, it was that thing. Didn't have a local PHP 8.5 version to test. Yeah, please backport d3ef806 or run the script with a lower PHP version. 8.1 isn't supported anymore and updating the branch doesn't make much sense. If you want to distribute this version, many other patches will be missing (which, while less severe, is still anything but optimal).