security: cap persistent_zval nesting depth, add fuzz target

persistent_zval_persist/_to_request/_free (zval.h) recurse once per
nesting level with no depth guard. A plain linear chain of nested
single-element arrays crashes the process (SIGBUS, native stack
overflow) around depth ~700 on a local debug build; sanitizer builds,
with much larger per-frame redzones, would hit it shallower still. Not
reachable today - the only caller is the FRANKENPHP_TEST-only roundtrip
hook, and zval.h itself is only compiled in under that guard, pending
the first real caller (background workers, per the comment at its
include site) - but it's a live landmine for whenever that lands: a
native stack overflow there kills the whole process, not just one
request.

persistent_zval_validate is the one gate every caller already runs
before persist/free/to_request, so it's the only safe place to reject
excess depth: rejecting there means persist never starts, so there's no
partially-persisted tree to unwind on the error path. Picked 256 as the
cap, the same order of magnitude as PHP's own defaults (json_decode()'s
$depth, Xdebug's max_nesting_level).

The new fuzz target's own builder script needed a fix too: growing every
slot at every level makes the tree size width**depth, which blows past
available memory (and hangs the fuzzer) well under the depth needed to
threaten the stack; only the first slot per level now recurses, so
total size is depth*width instead.

Author: dunglas

frankenphp.c

@@ -1056,8 +1056,9 @@ PHP_FUNCTION(frankenphp_test_persist_roundtrip) {
 
   if (!persistent_zval_validate(input)) {
     zend_throw_exception(spl_ce_LogicException,
-                         "persistent_zval: value type not supported "
-                         "(only scalars, arrays, and enums are allowed)",
+                         "persistent_zval: value not supported (only "
+                         "scalars, arrays, and enums are allowed, nested "
+                         "no deeper than PERSISTENT_ZVAL_MAX_DEPTH)",
                          0);
     RETURN_THROWS();
   }

frankenphp_test.go

@@ -1218,6 +1218,35 @@ func FuzzResponseHeaders(f *testing.F) {
 	})
 }
 
+// FuzzPersistZvalRoundtrip exercises zval.h's persistent_zval_persist/
+// _to_request/_free recursive tree walk: FrankenPHP's own mechanism for
+// carrying values across the request/persistent memory boundary (used by
+// worker state), not php-src itself. Nesting depth and width are
+// fuzzer-controlled, since unbounded native recursion (no depth guard) is
+// the interesting bug class here, not the value shapes themselves.
+func FuzzPersistZvalRoundtrip(f *testing.F) {
+	f.Add(0, 1)
+	f.Add(1, 1)
+	f.Add(10, 2)
+	f.Add(100, 1)
+	f.Add(1000, 1)
+	f.Add(-1, -1)
+
+	f.Fuzz(func(t *testing.T, depth, width int) {
+		runTest(t, func(handler func(http.ResponseWriter, *http.Request), _ *httptest.Server, _ int) {
+			req := httptest.NewRequest("GET", fmt.Sprintf("http://example.com/fuzz-persist-roundtrip.php?depth=%d&width=%d", depth, width), nil)
+			body, resp := testRequest(req, handler, t)
+
+			if body == "SKIP" {
+				t.Skip("FRANKENPHP_TEST not set; skipping persistent_zval roundtrip fuzzing")
+			}
+
+			assert.Equal(t, 200, resp.StatusCode)
+			assert.NotContains(t, body, "MISMATCH", "roundtrip changed the value for depth=%d width=%d", depth, width)
+		}, nil)
+	})
+}
+
 func TestSessionHandlerReset_worker(t *testing.T) {
 	runTest(t, func(_ func(http.ResponseWriter, *http.Request), ts *httptest.Server, i int) {
 		// Request 1: Set a custom session handler and start session

testdata/fuzz-persist-roundtrip.php

@@ -0,0 +1,43 @@
+<?php
+
+// Exercises zval.h's persistent_zval_persist/_to_request/_free recursive
+// tree walk (FrankenPHP's own worker-state mechanism, not php-src) via the
+// FRANKENPHP_TEST-only frankenphp_test_persist_roundtrip hook. Nesting
+// depth and width come from the query string so fuzzing controls the shape.
+
+$rt = 'frankenphp_test_persist_roundtrip';
+if (!function_exists($rt)) {
+    echo 'SKIP';
+    return;
+}
+
+$depth = max(0, min((int) ($_GET['depth'] ?? 0), 5000));
+$width = max(1, min((int) ($_GET['width'] ?? 1), 4));
+
+function frankenphp_fuzz_build_nested(int $depth, int $width): mixed
+{
+    if ($depth <= 0) {
+        return 'leaf';
+    }
+
+    // Only the first slot recurses; the rest are cheap leaves. This keeps
+    // the total node count linear in depth * width instead of width**depth
+    // (a naive every-slot-recurses builder would blow past available
+    // memory well before depth=50 at width=2), while still stressing
+    // exactly the same nesting depth per recursive C call.
+    $arr = ['leaf'];
+    for ($i = 1; $i < $width; $i++) {
+        $arr[$i] = 'leaf';
+    }
+    $arr[0] = frankenphp_fuzz_build_nested($depth - 1, $width);
+
+    return $arr;
+}
+
+$value = frankenphp_fuzz_build_nested($depth, $width);
+
+try {
+    echo $rt($value) === $value ? 'OK' : 'MISMATCH';
+} catch (\Throwable $e) {
+    echo 'THROWN:'.get_class($e);
+}

zval.h

@@ -3,7 +3,13 @@
  * Provides a small, self-contained toolkit for moving zval trees across
  * thread boundaries. The supported shape is a whitelist: scalars, arrays,
  * and enums. Everything else is rejected by persistent_zval_validate so
- * callers can fail fast before allocating.
+ * callers can fail fast before allocating. Nesting is also capped there
+ * (PERSISTENT_ZVAL_MAX_DEPTH): persist/free/to_request below recurse once
+ * per nesting level with no guard of their own, so every caller MUST run
+ * persistent_zval_validate first, on the full tree, before calling any of
+ * them - it's the only thing standing between attacker-controlled nesting
+ * depth and a native stack overflow (crashes the whole process, not just
+ * one request).
  *
  * Fast paths:
  *   - Interned strings: shared memory, no copy.
@@ -16,6 +22,14 @@
 
 #include <Zend/zend_enum.h>
 
+/* Conservative on purpose: comfortably below the depth that overflows the
+ * native stack even under sanitizer builds (larger per-frame redzones), far
+ * above any depth a legitimate config/state value would ever need. Matches
+ * the same order of magnitude as PHP's own default nesting caps (e.g.
+ * json_decode()'s default $depth of 512, Xdebug's max_nesting_level of
+ * 256). */
+#define PERSISTENT_ZVAL_MAX_DEPTH 256
+
 /* Enum payload stored in persistent memory: the class name + case name
  * are kept as persistent zend_strings and the case object is re-resolved
  * via zend_lookup_class + zend_enum_get_case_cstr on each read. */
@@ -26,8 +40,13 @@ typedef struct {
 
 /* Whitelist check: only scalars, arrays of allowed values, and enum
  * instances pass. Returns false for objects other than enums, resources,
- * closures, references, etc. */
-static bool persistent_zval_validate(zval *z) {
+ * closures, references, etc. Also enforces PERSISTENT_ZVAL_MAX_DEPTH,
+ * bailing out before recursing further once hit - see the file header for
+ * why this is the only place that's safe to do so. */
+static bool persistent_zval_validate_depth(zval *z, int depth) {
+  if (depth > PERSISTENT_ZVAL_MAX_DEPTH) {
+    return false;
+  }
   switch (Z_TYPE_P(z)) {
   case IS_NULL:
   case IS_FALSE:
@@ -47,7 +66,7 @@ static bool persistent_zval_validate(zval *z) {
       return true;
     zval *val;
     ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(z), val) {
-      if (!persistent_zval_validate(val))
+      if (!persistent_zval_validate_depth(val, depth + 1))
         return false;
     }
     ZEND_HASH_FOREACH_END();
@@ -58,6 +77,10 @@ static bool persistent_zval_validate(zval *z) {
   }
 }
 
+static bool persistent_zval_validate(zval *z) {
+  return persistent_zval_validate_depth(z, 0);
+}
+
 /* Deep-copy a zval from request memory into persistent (pemalloc) memory.
  * Callers must have already passed persistent_zval_validate on src.
  *