fix(php): backport security fixes to PHP 5.6 and 7.0-7.3

Author: zhengkunwang223

.github/workflows/php7-release.yml

@@ -4,6 +4,11 @@ run-name: Build PHP 7 Image ${{ github.event.inputs.php74ImageVersion }}, ${{ gi
 on:
   workflow_dispatch:
     inputs:
+      buildPhp74:
+        description: 'Build and publish PHP 7.4'
+        type: boolean
+        default: true
+        required: false
       php74Version:
         description: 'Official PHP 7.4 base version (7.4.33)'
         default: '7.4.33'
@@ -42,6 +47,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
       - name: Build PHP-7.4 and Push
+        if: ${{ inputs.buildPhp74 }}
         uses: docker/build-push-action@v6
         with:
           context: php/7

README.md

@@ -44,7 +44,7 @@ Commit and push the fixes, then select that branch in Actions. Existing images a
 | --- | --- | --- |
 | Build PHP 5 Image | `php56Version=5.6.40` | `5.6.40-fpm` (amd64) |
 | Build PHP 7 Legacy Images | No inputs; builds all three versions | `7.0.33-fpm`, `7.1.33-fpm`, `7.2.34-fpm` |
-| Build PHP 7 Image | `php74Version=7.4.33`, `php74ImageVersion=7.4.34`, `buildPhp73=true`, `php73Version=7.3.33` | `7.4.34-fpm`, `7.3.33-fpm` |
+| Build PHP 7 Image | `buildPhp74=true`, `php74Version=7.4.33`, `php74ImageVersion=7.4.34`, `buildPhp73=true`, `php73Version=7.3.33` | `7.4.34-fpm`, `7.3.33-fpm` |
 | Build PHP 8 Image | Run twice: `phpVersion=8.0.30`, then `8.1.34` | `8.0.31-fpm`, `8.1.35-fpm` |
 
 The legacy PHP 7 Action uses the existing Dockerfiles and preserves the previous workflow's amd64/arm64/arm/v7 platform list; local PECL installation checks cover amd64 only. The alternative `php/5.6` context remains available through CNB. Both 5.6 contexts include the PECL fix.
@@ -53,6 +53,8 @@ For PHP 8.2+, rebuild only images whose PEAR is older than 1.10.17. `Build PHP 8
 
 ## PHP EOL source backports
 
+PHP 5.6.40, 7.0.33, 7.1.33, 7.2.34 and 7.3.33 builds also apply SHA256-pinned local source backports, including the alternate `php/5.6` context. The third-party starting patches have been supplemented with applicable allocation-overflow, VM and request-state changes from PHP's minimal backport. Image tags and internal PHP versions stay unchanged. Use `tests/check-php-legacy-backport.py` for source checks and `tests/check-php-legacy-runtime.py IMAGE` for actual CLI/FPM regressions. These branches remain EOL; provenance, behavior changes and validation instructions are documented below.
+
 PHP 7.4.33, 8.0.30 and 8.1.34 builds apply the official minimal source backports for CVE-2026-109618 / CVE-2026-109619 and rebuild PHP. These branches remain EOL; older patch levels in these series now fail explicitly. `1panel/php:7.4.34-fpm`, `8.0.31-fpm` and `8.1.35-fpm` are 1Panel maintenance image tags based on official PHP 7.4.33, 8.0.30 and 8.1.34 respectively; their internal PHP versions remain unchanged. See [implementation, compatibility changes and validation](php/EOL-BACKPORT.md).
 
 ## PHP 7.3 / 7.4

README_zh.md

@@ -44,7 +44,7 @@ PHP 5.6、PHP 7 和 PHP 8 镜像在编译 PHP 后安装固定版本、校验 SHA
 | --- | --- | --- |
 | Build PHP 5 Image | `php56Version=5.6.40` | `5.6.40-fpm`（amd64） |
 | Build PHP 7 Legacy Images | 无参数，一次构建三个版本 | `7.0.33-fpm`、`7.1.33-fpm`、`7.2.34-fpm` |
-| Build PHP 7 Image | `php74Version=7.4.33`、`php74ImageVersion=7.4.34`、`buildPhp73=true`、`php73Version=7.3.33` | `7.4.34-fpm`、`7.3.33-fpm` |
+| Build PHP 7 Image | `buildPhp74=true`、`php74Version=7.4.33`、`php74ImageVersion=7.4.34`、`buildPhp73=true`、`php73Version=7.3.33` | `7.4.34-fpm`、`7.3.33-fpm` |
 | Build PHP 8 Image | 分别运行两次：`phpVersion=8.0.30`、`8.1.34` | `8.0.31-fpm`、`8.1.35-fpm` |
 
 旧 PHP 7 Action 使用已有 Dockerfile，保留此前工作流的 amd64/arm64/arm/v7 平台列表；本地 PECL 安装验证仅覆盖 amd64。备用 `php/5.6` 构建目录仍可通过 CNB 选择，两个 5.6 目录均包含 PECL 修复。
@@ -53,6 +53,8 @@ PHP 8.2+ 仅在镜像内 PEAR 低于 1.10.17 时需要为本问题重打。`Buil
 
 ## PHP EOL 源码回补
 
+PHP 5.6.40、7.0.33、7.1.33、7.2.34 和 7.3.33 的构建也会应用固定 SHA256 的本地源码回补。补丁以第三方回补为起点，并补齐官方最小回补中适用于各旧分支的分配溢出、VM 和请求状态清理等改动；备用 `php/5.6` 入口同样覆盖。镜像标签和内部 PHP 版本保持原值。源码校验使用 `tests/check-php-legacy-backport.py`，实际 CLI/FPM 回归使用 `tests/check-php-legacy-runtime.py IMAGE`。这些旧分支仍为 EOL，详细来源、行为变化和验证方式见下方说明。
+
 PHP 7.4.33、8.0.30 和 8.1.34 构建会应用官方针对 CVE-2026-109618 / CVE-2026-109619 的最小源码回补并重新编译 PHP。这些分支仍为 EOL，同系列更早的补丁版本现在会明确失败。`1panel/php:7.4.34-fpm`、`8.0.31-fpm` 和 `8.1.35-fpm` 为 1Panel 维护版镜像标签，分别基于官方 PHP 7.4.33、8.0.30、8.1.34 加上述回补，内部 PHP 版本保持原值。详见[实现、兼容性变化和验证说明](php/EOL-BACKPORT.md)。
 
 ## PHP 7.3 / 7.4

php/5.6.40/Dockerfile

@@ -23,6 +23,7 @@ RUN set -eux; \
 # dependencies required for running "phpize"
 # (see persistent deps below)
 ENV PHPIZE_DEPS \
+		patch \
 		autoconf \
 		dpkg-dev \
 		file \
@@ -107,6 +108,19 @@ RUN cd /tmp && \
     echo '/usr/local/ssl/lib' > /etc/ld.so.conf.d/openssl.conf && \
     ldconfig  /usr/local/openssl/lib
 
+COPY ./data/CVE-2026-109618-109619.patch /usr/local/share/php/security.patch
+
+RUN set -eux; \
+    echo '1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c  /usr/src/php.tar.xz' | sha256sum -c -; \
+    echo '7544944d5389d675b3f425b0bebc6abf86e1ff40b43c99b57d7c5d12370842fc  /usr/local/share/php/security.patch' | sha256sum -c -; \
+    docker-php-source extract; \
+    patch -d /usr/src/php -p1 -F0 -N --dry-run < /usr/local/share/php/security.patch; \
+    patch -d /usr/src/php -p1 -F0 -N < /usr/local/share/php/security.patch; \
+    tar --exclude=.docker-extracted -cJf /tmp/php-patched.tar.xz -C /usr/src php; \
+    mv /tmp/php-patched.tar.xz /usr/src/php.tar.xz; \
+    printf 'PHP 5.6.40\npatch-sha256 7544944d5389d675b3f425b0bebc6abf86e1ff40b43c99b57d7c5d12370842fc\noriginal-source-sha256 1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c\n' > /usr/local/share/php/eol-backport; \
+    sha256sum /usr/src/php.tar.xz >> /usr/local/share/php/eol-backport
+
 RUN set -eux; \
 	cd /tmp; \
 	tar -xzf curl-8.4.0.tar.gz; \
@@ -260,4 +274,13 @@ RUN usermod -u 1000 www-data && groupmod -g 1000 www-data
 ENTRYPOINT ["supervisord", "--nodaemon", "--configuration", "/etc/supervisord.conf"]
 
 EXPOSE 9000
-WORKDIR /www
+WORKDIR /www
+
+RUN set -eu; \
+    php-fpm -t; \
+    status=0; \
+    php -n -d memory_limit=16M -r 'register_shutdown_function(function () { echo "SHUTDOWN_RAN"; }); str_repeat("x", 32 * 1024 * 1024);' > /tmp/backport-oom.log 2>&1 || status=$?; \
+    [ "$status" = 1 ]; \
+    if grep -q SHUTDOWN_RAN /tmp/backport-oom.log; then exit 1; fi; \
+    grep -q 'Allowed memory size' /tmp/backport-oom.log; \
+    rm /tmp/backport-oom.log