php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Reset Z_EXTRA_P(op2) of ZEND_INIT_FCALL for opcache file cache

Browse Source 
The offset becomes stale if the environment changes. We're currently relying on
other factors in the environment staying constant, e.g. send types. But this
seems to be the worst offender.

Partially addresses GH-17733
Closes GH-20328
This commit is contained in:
Ilija Tovilo
2025-10-29 15:14:45 +01:00
parent a5e1baf6b8
commit 50c7f498b9
2 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -55,6 +55,8 @@ PHP NEWS
. Fixed bug GH-19875 (JIT 1205 segfault on large file compiled in subprocess).
(Arnaud)
. Fixed bug GH-20012 (heap buffer overflow in jit). (Arnaud)
. Partially fixed bug GH-17733 (Avoid calling wrong function when reusing file
caches across differing environments). (ilutov)
- PgSql:
. Fix memory leak when first string conversion fails. (nielsdos)

21
ext/opcache/zend_file_cache.c
View File

@@ -535,13 +535,32 @@ static void zend_file_cache_serialize_op_array(zend_op_array *op_arra
}
if (opline->op2_type == IS_CONST) {
SERIALIZE_PTR(opline->op2.zv);
/* See GH-17733. Reset Z_EXTRA_P(op2) of ZEND_INIT_FCALL, which
* is an offset into the global function table, to avoid calling
* incorrect functions when environment changes. This, and the
* equivalent code below, can be removed once proper system ID
* validation is implemented. */
if (opline->opcode == ZEND_INIT_FCALL) {
zval *op2 = opline->op2.zv;
UNSERIALIZE_PTR(op2);
Z_EXTRA_P(op2) = 0;
ZEND_VM_SET_OPCODE_HANDLER(opline);
}
}
#else
if (opline->op1_type == IS_CONST) {
opline->op1.constant = RT_CONSTANT(opline, opline->op1) - literals;
}
if (opline->op2_type == IS_CONST) {
opline->op2.constant = RT_CONSTANT(opline, opline->op2) - literals;
zval *op2 = RT_CONSTANT(opline, opline->op2);
opline->op2.constant = op2 - literals;
/* See GH-17733 and comment above. */
if (opline->opcode == ZEND_INIT_FCALL) {
Z_EXTRA_P(op2) = 0;
ZEND_VM_SET_OPCODE_HANDLER(opline);
}
}
#endif
#if ZEND_USE_ABS_JMP_ADDR