Skip to content

Commit 0055f1e

Browse files
committed
Fix #78761: Zend memory heap corruption with preload and casting
We have to reset `FFI_G(persistent)` back to zero when preloading has finished.
1 parent 1e2d3d5 commit 0055f1e

File tree

5 files changed

+23
-0
lines changed

5 files changed

+23
-0
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ PHP NEWS
1919
. Fixed bug #78716 (Function name mangling is wrong for some parameter
2020
types). (cmb)
2121
. Fixed bug #78762 (Failing FFI::cast() may leak memory). (cmb)
22+
. Fixed bug #78761 (Zend memory heap corruption with preload and casting).
23+
(cmb)
2224
. Implement FR #78270 (Support __vectorcall convention with FFI). (cmb)
2325

2426
- FPM:

ext/ffi/ffi.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3340,6 +3340,7 @@ static zend_ffi *zend_ffi_load(const char *filename, zend_bool preload) /* {{{ *
33403340
efree(code);
33413341
FFI_G(symbols) = NULL;
33423342
FFI_G(tags) = NULL;
3343+
FFI_G(persistent) = 0;
33433344

33443345
return ffi;
33453346

ext/ffi/tests/bug78761.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Bug #78761 (Zend memory heap corruption with preload and casting)
3+
--SKIPIF--
4+
<?php require_once('skipif.inc'); ?>
5+
--INI--
6+
opcache.enable_cli=1
7+
opcache.preload={PWD}/bug78761_preload.php
8+
--FILE--
9+
<?php
10+
try {
11+
FFI::cast('char[10]', FFI::new('char[1]'));
12+
} catch (FFI\Exception $ex) {
13+
echo $ex->getMessage(), PHP_EOL;
14+
}
15+
?>
16+
--EXPECT--
17+
attempt to cast to larger type

ext/ffi/tests/bug78761_preload.h

Whitespace-only changes.

ext/ffi/tests/bug78761_preload.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
3+
FFI::load(__DIR__ . '/bug78761_preload.h');

0 commit comments

Comments
 (0)