Windows: grow stream_select() fd_set on demand and cap handle count

On Windows the winsock fd_set is a packed array of SOCKETs bounded by the
compile-time FD_SETSIZE, so stream_select() silently dropped sockets past
that limit. Replace the fixed fd_set on the socket path with a growable
{capacity; fd_set} that doubles via realloc, giving parity with POSIX for
socket-heavy code. FD_ISSET/FD_ZERO/select() only read fd_count, so the
grown set is passed to them unchanged; php_select()'s internal working
sets grow too and the struct-assignment copies become memcpy. The POSIX
fd_bigset path and php_select()'s fd_set* ABI are unchanged.

Also cap the non-socket (pipe/file) handle path at MAXIMUM_WAIT_OBJECTS
(64) inside php_select() itself: it previously pushed each handle into a
fixed 64-entry stack array with no bound, crashing the process with a
stack buffer overrun (STATUS_STACK_BUFFER_OVERRUN) when given 65+ pipe or
file handles. It now returns an error so the caller reports a warning and
false. Fixing it in php_select() also protects the direct caller in
sapi/cli/php_cli_server.c.

Adds two Windows-only phpt tests: one selecting on more than FD_SETSIZE
sockets, and one asserting 65+ handles fail gracefully instead of
crashing.

Author: frodeborli

NEWS

@@ -95,6 +95,12 @@ PHP                                                                        NEWS
   . Fixed three Windows-only proc_open() defects: an uninitialized
     PROCESS_INFORMATION, an indeterminate comspec pointer after a failed
     lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)
+  . Fixed stream_select() on Windows overflowing a fixed 64-entry stack array
+    (crashing with a stack buffer overrun) when passed more than 64 pipe or file
+    handles; it now fails gracefully instead. (Frode Børli)
+  . Removed the FD_SETSIZE ceiling on the number of sockets stream_select() can
+    watch on Windows; the winsock fd_set now grows on demand, matching POSIX.
+    (Frode Børli)
 
 - Zlib:
   . Fixed inflate_init() dropping the preset dictionary for raw streams with

UPGRADING

@@ -1070,6 +1070,13 @@ PHP 8.6 UPGRADE NOTES
   . The OpenSSL library used by the official Windows builds has been upgraded
     to OpenSSL 4.
 
+- Standard:
+  . stream_select() no longer caps the number of sockets at FD_SETSIZE; the
+    winsock fd_set now grows on demand, so socket-heavy code (event loops,
+    servers) behaves like it does on POSIX. Selecting on more than 64 pipe or
+    file handles no longer crashes the process; it fails with a warning instead,
+    as that path is still bounded by the WaitForMultipleObjects() limit.
+
 ========================================
 13. Other Changes
 ========================================

ext/standard/streamsfuncs.c

@@ -799,7 +799,7 @@ static int stream_array_from_fd_bigset(zval *stream_array, const fd_bigset *fds)
 #else /* PHP_WIN32 */
 /* {{{ Windows keeps the original native fd_set based implementation for now (capped at FD_SETSIZE); see the
  * comment above the fd_bigset typedef for why. */
-static int stream_array_to_fd_set(const HashTable *stream_array, fd_set *fds, php_socket_t *max_fd)
+static int stream_array_to_fd_set(const HashTable *stream_array, php_growable_fd_set *fds, php_socket_t *max_fd)
 {
 	zval *elem;
 	php_stream *stream;
@@ -823,7 +823,7 @@ static int stream_array_to_fd_set(const HashTable *stream_array, fd_set *fds, ph
 		 * */
 		if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)&this_fd, 1) && this_fd != -1) {
 
-			PHP_SAFE_FD_SET(this_fd, fds);
+			php_growable_fd_set_add(fds, (SOCKET)this_fd);
 
 			if (this_fd > *max_fd) {
 				*max_fd = this_fd;
@@ -834,7 +834,7 @@ static int stream_array_to_fd_set(const HashTable *stream_array, fd_set *fds, ph
 	return cnt ? 1 : 0;
 }
 
-static int stream_array_from_fd_set(zval *stream_array, const fd_set *fds)
+static int stream_array_from_fd_set(zval *stream_array, const php_growable_fd_set *fds)
 {
 	zval *elem, *dest_elem;
 	HashTable *ht;
@@ -860,7 +860,7 @@ static int stream_array_from_fd_set(zval *stream_array, const fd_set *fds)
 		 * is not displayed.
 		 */
 		if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)&this_fd, 1) && this_fd != SOCK_ERR) {
-			if (PHP_SAFE_FD_ISSET(this_fd, fds)) {
+			if (FD_ISSET(this_fd, fds->set)) {
 				if (!key) {
 					dest_elem = zend_hash_index_update(ht, num_ind, elem);
 				} else {
@@ -936,7 +936,11 @@ static int stream_array_emulate_read_fd_set(zval *stream_array)
 	FD_BIGSET_FREE(&efds); \
 } while (0)
 #else
-# define STREAM_SELECT_FREE_SETS() do {} while (0)
+# define STREAM_SELECT_FREE_SETS() do { \
+	php_growable_fd_set_destroy(&rfds); \
+	php_growable_fd_set_destroy(&wfds); \
+	php_growable_fd_set_destroy(&efds); \
+} while (0)
 #endif
 
 /* {{{ Runs the select() system call on the sets of streams with a timeout specified by tv_sec and tv_usec */
@@ -947,7 +951,7 @@ PHP_FUNCTION(stream_select)
 #ifndef PHP_WIN32
 	fd_bigset rfds, wfds, efds;
 #else
-	fd_set rfds, wfds, efds;
+	php_growable_fd_set rfds, wfds, efds;
 #endif
 	php_socket_t max_fd = 0;
 	int retval, sets = 0;
@@ -1011,9 +1015,11 @@ PHP_FUNCTION(stream_select)
 		sets += set_count;
 	}
 #else
-	FD_ZERO(&rfds);
-	FD_ZERO(&wfds);
-	FD_ZERO(&efds);
+	/* Size the growable sets to each array's element count (clamped to at least
+	 * FD_SETSIZE); they still grow on demand, so this is only a starting guess. */
+	php_growable_fd_set_init(&rfds, r_array != NULL ? zend_hash_num_elements(Z_ARR_P(r_array)) : 0);
+	php_growable_fd_set_init(&wfds, w_array != NULL ? zend_hash_num_elements(Z_ARR_P(w_array)) : 0);
+	php_growable_fd_set_init(&efds, e_array != NULL ? zend_hash_num_elements(Z_ARR_P(e_array)) : 0);
 
 	if (r_array != NULL) {
 		set_count = stream_array_to_fd_set(Z_ARR_P(r_array), &rfds, &max_fd);
@@ -1116,7 +1122,7 @@ PHP_FUNCTION(stream_select)
 
 	retval = php_select(max_fd + 1, (fd_set *) rfds.fds_bits, (fd_set *) wfds.fds_bits, (fd_set *) efds.fds_bits, tv_p);
 #else
-	retval = php_select(max_fd + 1, &rfds, &wfds, &efds, tv_p);
+	retval = php_select(max_fd + 1, rfds.set, wfds.set, efds.set, tv_p);
 #endif
 	php_stream_error_operation_end(context);
 

ext/standard/tests/streams/stream_select_win32_many_sockets.phpt

@@ -0,0 +1,44 @@
+--TEST--
+stream_select(): more than FD_SETSIZE sockets on Windows (growable fd_set)
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Windows') die('skip Windows only');
+?>
+--FILE--
+<?php
+/* On Windows the winsock fd_set is a packed array of SOCKETs capped at the
+ * compile-time FD_SETSIZE (default 256, see --enable-fd-setsize). stream_select()
+ * now grows the set on demand, so it can watch far more than FD_SETSIZE sockets,
+ * matching POSIX behaviour. Here we select on FD_SETSIZE + 50 readable sockets
+ * and expect every one to be reported ready; before the fix the winsock FD_SET
+ * macro silently dropped everything past FD_SETSIZE. */
+$target = PHP_FD_SETSIZE + 50;
+$pairs = [];
+$reads = [];
+for ($i = 0; $i < $target; $i++) {
+    $p = stream_socket_pair(STREAM_PF_INET, STREAM_SOCK_STREAM, STREAM_IPPROTO_IP);
+    if ($p === false) {
+        break;
+    }
+    fwrite($p[0], "x");
+    $pairs[] = $p;
+    $reads[] = $p[1];
+}
+
+$r = $reads;
+$w = $e = null;
+$ready = stream_select($r, $w, $e, 2, 0);
+
+var_dump(count($reads) === $target);
+var_dump($ready === $target);
+var_dump(count($r) === $target);
+
+foreach ($pairs as $p) {
+    fclose($p[0]);
+    fclose($p[1]);
+}
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)

ext/standard/tests/streams/stream_select_win32_max_handles.phpt

@@ -0,0 +1,40 @@
+--TEST--
+stream_select(): >64 non-socket handles fail gracefully on Windows (no stack overflow)
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY !== 'Windows') die('skip Windows only');
+?>
+--FILE--
+<?php
+/* On Windows stream_select() multiplexes non-socket handles (pipes, files)
+ * through WaitForMultipleObjects(), which cannot wait on more than
+ * MAXIMUM_WAIT_OBJECTS (64) handles at once. php_select() used to push each
+ * handle into a fixed 64-slot stack array with no bounds check, so selecting on
+ * 65+ file/pipe handles overran the stack and crashed the process with
+ * STATUS_STACK_BUFFER_OVERRUN (0xC0000409). It must instead fail gracefully
+ * (warning + false). This test crashes every unpatched PHP build on Windows and
+ * passes only once the cap is in place. */
+$files = [];
+for ($i = 0; $i < 70; $i++) {
+    $path = __DIR__ . "/stream_select_win32_max_handles_$i.tmp";
+    file_put_contents($path, "d");
+    $files[] = fopen($path, "rb");
+}
+
+$r = $files;
+$w = $e = null;
+var_dump(stream_select($r, $w, $e, 0, 0));
+
+foreach ($files as $f) {
+    fclose($f);
+}
+?>
+--EXPECTF--
+Warning: stream_select(): Unable to select [%d]: %s (max_fd=%d) in %s on line %d
+bool(false)
+--CLEAN--
+<?php
+for ($i = 0; $i < 70; $i++) {
+    @unlink(__DIR__ . "/stream_select_win32_max_handles_$i.tmp");
+}
+?>

main/php_network.h

@@ -248,6 +248,75 @@ static inline bool _php_check_fd_setsize(php_socket_t *max_fd, int setsize)
 # define PHP_SAFE_MAX_FD(m, n)		_php_check_fd_setsize(&m, n)
 #endif
 
+#ifdef PHP_WIN32
+/* {{{ Growable winsock fd_set.
+ *
+ * On Windows fd_set is a *packed array* of SOCKETs ({ u_int fd_count; SOCKET
+ * fd_array[FD_SETSIZE]; }), not a bitset, so the traditional FD_SETSIZE ceiling
+ * caps the *number* of sockets rather than their descriptor value.
+ * php_growable_fd_set lifts that limit by keeping the winsock fd_set on the heap
+ * and doubling fd_array on demand. Because select()/FD_ISSET/FD_ZERO only ever
+ * read fd_count, `set` can be handed to them directly at any size. Windows only;
+ * the POSIX build grows a bitset (fd_bigset) instead - see
+ * ext/standard/streamsfuncs.c. */
+typedef struct {
+	u_int   capacity;   /* number of SOCKET slots backing set->fd_array */
+	fd_set *set;        /* heap block laid out as a winsock fd_set of `capacity` slots */
+} php_growable_fd_set;
+
+# define PHP_GROWABLE_FD_SET_ALLOC_SIZE(cap) \
+	(offsetof(fd_set, fd_array) + (size_t)(cap) * sizeof(SOCKET))
+
+static zend_always_inline void php_growable_fd_set_init(php_growable_fd_set *s, u_int capacity)
+{
+	if (capacity < FD_SETSIZE) {
+		capacity = FD_SETSIZE;
+	}
+	s->capacity = capacity;
+	s->set = (fd_set *) pemalloc(PHP_GROWABLE_FD_SET_ALLOC_SIZE(capacity), 1);
+	s->set->fd_count = 0;
+}
+
+static zend_always_inline void php_growable_fd_set_destroy(php_growable_fd_set *s)
+{
+	if (s->set) {
+		pefree(s->set, 1);
+		s->set = NULL;
+	}
+	s->capacity = 0;
+}
+
+static zend_always_inline void php_growable_fd_set_zero(php_growable_fd_set *s)
+{
+	s->set->fd_count = 0;
+}
+
+static zend_always_inline void php_growable_fd_set_reserve(php_growable_fd_set *s, u_int needed)
+{
+	if (needed > s->capacity) {
+		do {
+			s->capacity *= 2;
+		} while (needed > s->capacity);
+		s->set = (fd_set *) perealloc(s->set, PHP_GROWABLE_FD_SET_ALLOC_SIZE(s->capacity), 1);
+	}
+}
+
+static zend_always_inline void php_growable_fd_set_add(php_growable_fd_set *s, SOCKET fd)
+{
+	/* fds within a single stream_select() array are already unique, so we skip
+	 * the O(n) duplicate scan that winsock's FD_SET macro performs. */
+	php_growable_fd_set_reserve(s, s->set->fd_count + 1);
+	s->set->fd_array[s->set->fd_count++] = fd;
+}
+
+static zend_always_inline void php_growable_fd_set_copy(php_growable_fd_set *dst, const php_growable_fd_set *src)
+{
+	php_growable_fd_set_reserve(dst, src->set->fd_count);
+	memcpy(dst->set, src->set, PHP_GROWABLE_FD_SET_ALLOC_SIZE(src->set->fd_count));
+}
+/* }}} */
+#endif
+
 
 #define PHP_SOCK_CHUNK_SIZE	8192