From ccef1f145fdb955cb5c93577d521e8150d0de8cb Mon Sep 17 00:00:00 2001 From: Sovran Systems Date: Fri, 23 Oct 2026 01:46:23 +0000 Subject: [PATCH] php: fix the filter tests that break the 8.5.12 build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 8.5.12 pin in 39ed0cc/be9afb2 builds the interpreter but the system build stopped in php-filter's checkPhase: FAILED TEST SUMMARY filter.default=encoded doesn't reach hard limit [tests/oom_filter_default_encoded.phpt] filter_input() doesn't reach hard limit [tests/oom_filter_input.phpt] filter_input_array() doesn't reach hard limit [tests/oom_filter_input_array.phpt] make: *** [Makefile:133: test] Error 1 Not a fault in the pin. nixpkgs configures PHP with `--disable-all` and builds every extension as a shared module, while these three tests — added by the upstream fix for CVE-2026-109618 — deliberately spawn `php-cgi -n` with no php.ini. With no ini there is no shared filter module, so filter_input() is undefined, the request never reaches the code under test, and the expected "Allowed memory size ... exhausted" never appears. nixpkgs shipped the remedy with the version bump in a5fc1be5b6 ("php: fix `filter` tests", 2026-10-21 14:27 UTC), which adds the module to the child's command line. The pinned nixpkgs revision (7694c4f6b853, 2026-10-16) predates it, so apply the same substitution locally. The override has to rewrite the filter derivation inside `extensions` rather than go through buildEnv's `packageOverrides`: that argument is threaded into the unwrapped PHP only, while the extension set is folded from mkPhp's own packageOverrides, so passing it there is accepted and silently ignored. Drop this block once flake.lock is past a5fc1be5b6 — otherwise both patch the same files and the substitution is applied twice. Verified by evaluating both derivations against the pinned revision: the filter derivation now carries the substitution, php-with-extensions is 8.5.12, and the 45-extension set is unchanged. --- modules/php.nix | 48 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/modules/php.nix b/modules/php.nix index 89ed70a..4e3828d 100755 --- a/modules/php.nix +++ b/modules/php.nix @@ -62,13 +62,47 @@ let # xmlreader, xmlwriter, zip, zlib, pdo_pgsql, pdo_mysql, bcmath, gmp, # exif, sodium, sysvsem, pcntl, ...). OPcache is compiled into PHP >= 8.5 # and no longer appears as a separate extension. - extensions = { enabled, all }: enabled ++ (with all; [ - bz2 # Nextcloud: bz2 archive support - apcu # Nextcloud: memcache.local (apc.enable_cli=1 below is mandatory for occ + cron) - redis # Nextcloud: memcache.distributed / file locking once a Redis server is configured - imagick # Nextcloud: previews + theming (nixpkgs ImageMagick is built with SVG support) - memcached # WordPress object-cache plugins (legacy option for Nextcloud) - ]); + extensions = { enabled, all }: + let + # nixpkgs builds PHP with `--disable-all` and every extension as a + # shared module. Three of the OOM regression tests shipped with + # 8.5.12 spawn `php-cgi -n` on purpose — no php.ini, so no shared + # module, so filter_input() is never defined and the request never + # reaches the code under test. php-filter's `make test` then fails + # with "doesn't reach hard limit" for oom_filter_input, + # oom_filter_input_array and oom_filter_default_encoded, and the + # whole system build stops there. + # + # Upstream nixpkgs fixes this in a5fc1be5b6 ("php: fix `filter` + # tests"), shipped alongside the 8.5.12 bump. This lock predates + # it, so apply the same substitution here; drop this once flake.lock + # is past a5fc1be5b6, since the two would otherwise both patch. + # + # Done by rewriting the filter derivation in the extension list + # rather than through buildEnv's `packageOverrides`: that argument + # only reaches the unwrapped PHP, while the extension set is folded + # from mkPhp's own packageOverrides, so it is silently ignored here. + patchFilterTests = ext: + if (ext.extensionName or "") != "filter" then + ext + else + ext.overrideAttrs (prevAttrs: { + postConfigure = (prevAttrs.postConfigure or "") + '' + substituteInPlace \ + tests/oom_filter_input.phpt \ + tests/oom_filter_input_array.phpt \ + tests/oom_filter_default_encoded.phpt \ + --replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so'," + ''; + }); + in + map patchFilterTests enabled ++ (with all; [ + bz2 # Nextcloud: bz2 archive support + apcu # Nextcloud: memcache.local (apc.enable_cli=1 below is mandatory for occ + cron) + redis # Nextcloud: memcache.distributed / file locking once a Redis server is configured + imagick # Nextcloud: previews + theming (nixpkgs ImageMagick is built with SVG support) + memcached # WordPress object-cache plugins (legacy option for Nextcloud) + ]); extraConfig = '' ; ── Error handling (production) ─────────────────────────────────