Merge branch 'PHP-8.6'

Author: devnexen

main/php_ini.c

@@ -560,7 +560,13 @@ void php_init_config(void)
 					fp = VCWD_FOPEN(php_ini_file_name, "r");
 					if (fp) {
 						filename = expand_filepath(php_ini_file_name, NULL);
-						free_filename = true;
+						if (filename) {
+							free_filename = true;
+						} else {
+							/* Reject the file, like ZTS where VCWD_STAT() already fails */
+							fclose(fp);
+							fp = NULL;
+						}
 					}
 				}
 			}

sapi/cli/tests/gh24139.phpt

@@ -0,0 +1,30 @@
+--TEST--
+GH-24139 (NULL pointer dereference in php_ini.c when expand_filepath() fails)
+--SKIPIF--
+<?php
+include "skipif.inc";
+if (PHP_OS_FAMILY === "Windows") die("skip not for Windows");
+?>
+--FILE--
+<?php
+$ini_file = __DIR__ . "/gh24139.ini";
+file_put_contents($ini_file, "gh24139=ok\n");
+
+$relative = str_repeat("./", intdiv(PHP_MAXPATHLEN - strlen(__DIR__), 2)) . "gh24139.ini";
+
+$proc = proc_open(
+    [getenv("TEST_PHP_EXECUTABLE"), "-c", $relative, "-r", 'var_dump(get_cfg_var("gh24139"));'],
+    [1 => ["pipe", "w"]],
+    $pipes,
+    __DIR__
+);
+echo stream_get_contents($pipes[1]);
+var_dump(proc_close($proc));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . "/gh24139.ini");
+?>
+--EXPECT--
+bool(false)
+int(0)