php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3'

Browse Source 
* PHP-8.3:
  [ci skip] NEWS for GH-14626
  [ci skip] NEWS for GH-14626
  Fix is_zend_ptr() for huge blocks (#14626)
This commit is contained in:
Arnaud Le Blanc
2024-06-25 15:18:58 +02:00
parent df6d85acf8 a5a75ae39d
commit f7df238971
6 changed files with 78 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
Zend/tests/gh14626.phpt Normal file
View File

@@ -0,0 +1,18 @@
--TEST--
GH-14626: is_zend_ptr() may crash for non-zend ptrs when huge blocks exist
--EXTENSIONS--
zend_test
--FILE--
<?php
// Ensure there is at least one huge_block
$str = str_repeat('a', 2*1024*1024);
// Check that is_zend_ptr() does not crash
zend_test_is_zend_ptr(0);
zend_test_is_zend_ptr(1<<30);
?>
==DONE==
--EXPECT--
==DONE==

18
Zend/zend_alloc.c
View File

@@ -2654,17 +2654,15 @@ ZEND_API bool is_zend_ptr(const void *ptr)
} while (chunk != AG(mm_heap)->main_chunk);
}
if (AG(mm_heap)->huge_list) {
zend_mm_huge_list *block = AG(mm_heap)->huge_list;
do {
if (ptr >= (void*)block
&& ptr < (void*)((char*)block + block->size)) {
return 1;
}
block = block->next;
} while (block != AG(mm_heap)->huge_list);
zend_mm_huge_list *block = AG(mm_heap)->huge_list;
while (block) {
if (ptr >= (void*)block
&& ptr < (void*)((char*)block + block->size)) {
return 1;
}
block = block->next;
}
return 0;
}

32
ext/ffi/tests/gh14626.phpt Normal file
View File

@@ -0,0 +1,32 @@
--TEST--
GH-14626: FFI::free() may crash in is_zend_ptr() when at least one huge block exists and the ptr is non-zend
--EXTENSIONS--
ffi
--SKIPIF--
<?php
if (substr(PHP_OS, 0, 3) == 'WIN') die("skip no malloc() on windows");
?>
--INI--
ffi.enable=1
--FILE--
<?php
// Ensure there is at least one huge_block
$str = str_repeat('a', 2*1024*1024);
$ffi = FFI::cdef(<<<C
void *malloc(size_t size);
C);
$ptr = $ffi->malloc(10);
$addr = $ffi->cast("uintptr_t", $ffi->cast("char*", $ptr))->cdata;
$ptr = FFI::cdef()->cast("char*", $addr);
// Should not crash in is_zend_ptr()
FFI::free($ptr);
?>
==DONE==
--EXPECT--
==DONE==

11
ext/zend_test/test.c
View File

@@ -814,6 +814,17 @@ static ZEND_FUNCTION(zend_test_cast_fread)
}
}
static ZEND_FUNCTION(zend_test_is_zend_ptr)
{
zend_long addr;
ZEND_PARSE_PARAMETERS_START(1, 1)
Z_PARAM_LONG(addr);
ZEND_PARSE_PARAMETERS_END();
RETURN_BOOL(is_zend_ptr((void*)addr));
}
static zend_object *zend_test_class_new(zend_class_entry *class_type)
{
zend_object *obj = zend_objects_new(class_type);

2
ext/zend_test/test.stub.php
View File

@@ -294,6 +294,8 @@ function zend_test_override_libxml_global_state(): void {}
/** @param resource $stream */
function zend_test_cast_fread($stream): void {}
function zend_test_is_zend_ptr(int $addr): bool {}
}
namespace ZendTestNS {

8
ext/zend_test/test_arginfo.h generated
View File

@@ -1,5 +1,5 @@
/* This is a generated file, edit the .stub.php file instead.
* Stub hash: b7e8a9c27def16e8691883bea7837def1f717ab8 */
* Stub hash: 6b49c60e3b86415a0e0d95cd915419fac39de531 */
ZEND_STATIC_ASSERT(PHP_VERSION_ID >= 80000, "test_arginfo.h only supports PHP version ID 80000 or newer, "
"but it is included on an older PHP version");
@@ -164,6 +164,10 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_zend_test_cast_fread, 0, 1, IS_V
ZEND_ARG_INFO(0, stream)
ZEND_END_ARG_INFO()
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_zend_test_is_zend_ptr, 0, 1, _IS_BOOL, 0)
ZEND_ARG_TYPE_INFO(0, addr, IS_LONG, 0)
ZEND_END_ARG_INFO()
#define arginfo_ZendTestNS2_namespaced_func arginfo_zend_test_is_pcre_bundled
#define arginfo_ZendTestNS2_namespaced_deprecated_func arginfo_zend_test_void_return
@@ -295,6 +299,7 @@ static ZEND_FUNCTION(zend_test_is_pcre_bundled);
static ZEND_FUNCTION(zend_test_set_fmode);
#endif
static ZEND_FUNCTION(zend_test_cast_fread);
static ZEND_FUNCTION(zend_test_is_zend_ptr);
static ZEND_FUNCTION(ZendTestNS2_namespaced_func);
static ZEND_FUNCTION(ZendTestNS2_namespaced_deprecated_func);
static ZEND_FUNCTION(ZendTestNS2_ZendSubNS_namespaced_func);
@@ -394,6 +399,7 @@ static const zend_function_entry ext_functions[] = {
ZEND_FE(zend_test_set_fmode, arginfo_zend_test_set_fmode)
#endif
ZEND_FE(zend_test_cast_fread, arginfo_zend_test_cast_fread)
ZEND_FE(zend_test_is_zend_ptr, arginfo_zend_test_is_zend_ptr)
#if (PHP_VERSION_ID >= 80400)
ZEND_RAW_FENTRY(ZEND_NS_NAME("ZendTestNS2", "namespaced_func"), zif_ZendTestNS2_namespaced_func, arginfo_ZendTestNS2_namespaced_func, 0, NULL, NULL)
#else