[programsurf]

This extends the session-preservation approach proposed in php/php-src#24521. In addition to preserving the stored session after a rejected upload-progress decode, it releases the retained lazy-write buffer to prevent avoidable memory-limit failures during subsequent progress updates.

Background:

• The official PHP 8.4 security change 3584a98b hardened startup state handling and upload-progress session decoding.
• Issue #24493 reports that the restricted decoder can reject application-generated object properties and delete the entire session record.
• PR #24521, including commit a45ffe71a56741579f648d969193bd027a783e36, proposed aborting the progress update instead of destroying the session. This PR builds on that approach and adds buffer cleanup and regression coverage.

The additional problem is that php_session_abort() leaves PS(session_vars) allocated. The next progress update reads the session again before php_session_initialize() releases that buffer. With session.lazy_write=1, two serialized records temporarily remain live at once.

A valid three-byte upload with a roughly 5 MiB stored session and an 8 MiB upload-request memory limit terminates during request startup:

Allowed memory size of 8388608 bytes exhausted
(tried to allocate 5243032 bytes)

The session is seeded and subsequently inspected under a 64 MiB limit; the upload request does not call session_start() in application code. The abort-only version fails, while disabling lazy writing or releasing the unused buffer allows the same upload to complete. The failure also reproduces in a build without AddressSanitizer.

This change releases and clears PS(session_vars) immediately after aborting an upload-progress decode failure. It retains the stored session record and session identifier, and leaves the restricted decoder checks and public session_abort() behavior unchanged.

Regression coverage:

• Public-API session round trips across all three serializers, reserved and ordinary property names, and both upload-progress cleanup settings.
• A memory-pressure test checking successful upload, exact file contents, unchanged stored session bytes, and subsequent application session values.
• All six memory-pressure combinations fail on the abort-only version and pass with the buffer release.

Validation on PHP 8.4: 268 session PHPTs passed, 1 expected failure, 1 skipped, and 0 unexpected failures. Repeated FPM replay confirms upload completion and session preservation after the fix. Existing session-preservation checks and the original security reproducer retain their expected results.

[programsurf]

@Girgias @jorgsowa - this is ready for review after rebasing onto PHP-8.4. CI is now green, including macOS.

The production change is limited to 11 lines in ext/session/session.c; the remaining changes are regression tests.

In addition to preserving the session record, this releases the unused PS(session_vars) buffer after an aborted upload-progress update. Without that cleanup, a 3-byte upload can still exhaust an 8 MiB request limit with a roughly 5 MiB stored session.

The memory regression test covers all three serializers and both cleanup settings: all six combinations fail with abort alone and pass with the buffer release. The restricted decoder checks remain unchanged.

Could you review the buffer lifetime and session-preservation behavior in php_session_cancel_decode()?

Thank you