Repository navigation
Surfacing security issues with OpenBSD as part of the CI with hardened memory allocator #24669
Description
Description
Hi folks,
We are analysing the PHP code and while it's clear that there are performance benefits from PHP current ZendMM allocator, we also see benefits from disabling it as a build option to surface memory corruption security bugs.
OpenBSD has a hardened memory allocator which can surface a lot of those security issues:
OpenBSD malloc
Would the PHP team be willing to accept a PR for the CI which adds OpenBSD as a runner for CI builds with USE_ZEND_ALLOC=0 activated ?
Activity
loganaden commentedon Oct 25, 2026
@iluuu1994 there is already a FreeBSD VM: https://github.com/php/php-src/blob/master/.github/actions/freebsd/action.yml. We can build the same for OpenBSD with
USE_ZEND_ALLOC=0? we would be happy to help maintain this as part of the CI as we use OpenBSD a lot.Digi-Levy commentedon Oct 25, 2026
This is a sensible proposal. OpenBSD hardened allocator can help identify security issues early.
iluuu1994 commentedon Oct 28, 2026
USE_ZEND_ALLOC=0can leak memory on fatal errors such as timeouts. We're considering getting rid oflongjmp()completely, which would make this possible.loganaden commentedon Oct 28, 2026
@iluuu1994 how can we help with getting rid of longjmp() ?