Fix GH-17951: Addition of max_memory_limit INI

Closes GH-18011

Author: frederikpyt

UPGRADING

@@ -629,6 +629,11 @@ PHP 8.5 UPGRADE NOTES
   . Added fatal_error_backtraces to control whether fatal errors should include
     a backtrace.
     RFC: https://wiki.php.net/rfc/error_backtraces_v2
+  . Added startup-only max_memory_limit INI setting to control the maximum
+    memory_limit that may be configured at startup or runtime. Exceeding this
+    value emits a warning, unless set to -1, and sets memory_limit to the
+    current max_memory_limit instead.
+    ML discussion: https://externals.io/message/127108
 
 - Opcache:
   . Added opcache.file_cache_read_only to support a read-only

main/main.c

@@ -332,6 +332,33 @@ static PHP_INI_MH(OnChangeMemoryLimit)
 	} else {
 		value = Z_L(1)<<30;		/* effectively, no limit */
 	}
+
+	/* If max_memory_limit is not set to unlimited, verify change */
+	if (PG(max_memory_limit) != -1) {
+		if (value == -1) {
+			zend_error(
+				E_WARNING,
+				"Failed to set memory_limit to unlimited. memory_limit (currently: " ZEND_LONG_FMT " bytes) cannot be set to unlimited if max_memory_limit (" ZEND_LONG_FMT " bytes) is not unlimited",
+				PG(memory_limit),
+				PG(max_memory_limit)
+			);
+
+			return FAILURE;
+		}
+
+		if (value > PG(max_memory_limit)) {
+			zend_error(
+				E_WARNING,
+				"Failed to set memory_limit to %zd bytes. memory_limit (currently: " ZEND_LONG_FMT " bytes) cannot exceed max_memory_limit (" ZEND_LONG_FMT " bytes)",
+				value,
+				PG(memory_limit),
+				PG(max_memory_limit)
+			);
+
+			return FAILURE;
+		}
+	}
+
 	if (zend_set_memory_limit(value) == FAILURE) {
 		/* When the memory limit is reset to the original level during deactivation, we may be
 		 * using more memory than the original limit while shutdown is still in progress.
@@ -347,6 +374,26 @@ static PHP_INI_MH(OnChangeMemoryLimit)
 }
 /* }}} */
 
+static PHP_INI_MH(OnChangeMaxMemoryLimit)
+{
+	size_t value;
+	if (new_value) {
+		value = zend_ini_parse_uquantity_warn(new_value, entry->name);
+	} else {
+		value = Z_L(1) << 30; /* effectively, no limit */
+	}
+
+	if (zend_set_memory_limit(value) == FAILURE) {
+		zend_error(E_ERROR, "Failed to set memory limit to %zd bytes (Current memory usage is %zd bytes)", value, zend_memory_usage(true));
+		return FAILURE;
+	}
+
+	PG(memory_limit) = value;
+	PG(max_memory_limit) = value;
+
+	return SUCCESS;
+}
+
 /* {{{ PHP_INI_MH */
 static PHP_INI_MH(OnSetLogFilter)
 {
@@ -810,7 +857,10 @@ PHP_INI_BEGIN()
 	STD_PHP_INI_BOOLEAN("mail.mixed_lf_and_crlf",			"0",		PHP_INI_SYSTEM|PHP_INI_PERDIR,		OnUpdateBool,			mail_mixed_lf_and_crlf,			php_core_globals,	core_globals)
 	STD_PHP_INI_ENTRY("mail.log",					NULL,		PHP_INI_SYSTEM|PHP_INI_PERDIR,		OnUpdateMailLog,			mail_log,			php_core_globals,	core_globals)
 	PHP_INI_ENTRY("browscap",					NULL,		PHP_INI_SYSTEM,		OnChangeBrowscap)
-	PHP_INI_ENTRY("memory_limit",				"128M",		PHP_INI_ALL,		OnChangeMemoryLimit)
+
+	PHP_INI_ENTRY("max_memory_limit",		"-1",		PHP_INI_SYSTEM,		OnChangeMaxMemoryLimit)
+	PHP_INI_ENTRY("memory_limit",			"128M",		PHP_INI_ALL,		OnChangeMemoryLimit)
+
 	PHP_INI_ENTRY("precision",					"14",		PHP_INI_ALL,		OnSetPrecision)
 	PHP_INI_ENTRY("sendmail_from",				NULL,		PHP_INI_ALL,		NULL)
 	PHP_INI_ENTRY("sendmail_path",	DEFAULT_SENDMAIL_PATH,	PHP_INI_SYSTEM,		NULL)

main/php_globals.h

@@ -72,6 +72,7 @@ struct _php_core_globals {
 	zend_long serialize_precision;
 
 	zend_long memory_limit;
+	zend_long max_memory_limit;
 	zend_long max_input_time;
 
 	char *error_log;

php.ini-development

@@ -436,6 +436,7 @@ max_input_time = 60
 ; Maximum amount of memory a script may consume
 ; https://php.net/memory-limit
 memory_limit = 128M
+max_memory_limit = -1
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ; Error handling and logging ;

php.ini-production

@@ -438,6 +438,7 @@ max_input_time = 60
 ; Maximum amount of memory a script may consume
 ; https://php.net/memory-limit
 memory_limit = 128M
+max_memory_limit = -1
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ; Error handling and logging ;

tests/basic/gh17951_ini_parse_1.phpt

@@ -0,0 +1,15 @@
+--TEST--
+GH-17951 INI Parse 1
+--CREDITS--
+Frederik Milling Pytlick ([email protected])
+--INI--
+memory_limit=128M
+max_memory_limit=-1
+--FILE--
+<?php
+echo ini_get('max_memory_limit') . PHP_EOL;
+echo ini_get('memory_limit') . PHP_EOL;
+?>
+--EXPECT--
+-1
+128M

tests/basic/gh17951_ini_parse_2.phpt

@@ -0,0 +1,15 @@
+--TEST--
+GH-17951 INI Parse 2
+--CREDITS--
+Frederik Milling Pytlick ([email protected])
+--INI--
+memory_limit=-1
+max_memory_limit=-1
+--FILE--
+<?php
+echo ini_get('max_memory_limit') . PHP_EOL;
+echo ini_get('memory_limit') . PHP_EOL;
+?>
+--EXPECT--
+-1
+-1

tests/basic/gh17951_ini_parse_3.phpt

@@ -0,0 +1,15 @@
+--TEST--
+GH-17951 INI Parse 3
+--CREDITS--
+Frederik Milling Pytlick ([email protected])
+--INI--
+memory_limit=128M
+max_memory_limit=256M
+--FILE--
+<?php
+echo ini_get('max_memory_limit') . PHP_EOL;
+echo ini_get('memory_limit') . PHP_EOL;
+?>
+--EXPECT--
+256M
+128M

tests/basic/gh17951_ini_parse_4.phpt

@@ -0,0 +1,15 @@
+--TEST--
+GH-17951 INI Parse 4
+--CREDITS--
+Frederik Milling Pytlick ([email protected])
+--INI--
+memory_limit=-1
+max_memory_limit=128M
+--FILE--
+<?php
+echo ini_get('max_memory_limit') . PHP_EOL;
+echo ini_get('memory_limit') . PHP_EOL;
+--EXPECTF--
+Warning: Failed to set memory_limit to unlimited. memory_limit (currently: %d bytes) cannot be set to unlimited if max_memory_limit (%d bytes) is not unlimited in %s
+128M
+128M

tests/basic/gh17951_ini_parse_5.phpt

@@ -0,0 +1,15 @@
+--TEST--
+GH-17951 INI Parse 5
+--CREDITS--
+Frederik Milling Pytlick ([email protected])
+--INI--
+memory_limit=256M
+max_memory_limit=128M
+--FILE--
+<?php
+echo ini_get('max_memory_limit') . PHP_EOL;
+echo ini_get('memory_limit') . PHP_EOL;
+--EXPECTF--
+Warning: Failed to set memory_limit to %d bytes. memory_limit (currently: %d bytes) cannot exceed max_memory_limit (%d bytes) in %s
+128M
+128M