Fix #80663: Recursive SplFixedArray::setSize() may cause double-free#7503
Fix #80663: Recursive SplFixedArray::setSize() may cause double-free#7503cmb69 wants to merge 6 commits intophp:PHP-7.4from
Conversation
We address the `::setSize(0)` case by setting `array->element = NULL` before we destroy the elements, and bail in this case out on re-entry into `spl_fixedarray_resize()`.
Co-authored-by: Tyson Andre <[email protected]>
|
The new test case (bug80663.phpt) was failing after the last commit; I've updated the test accordingly. Are we still good with this change for PHP-7.4? Also, there are relevant changes in PHP-8.0 (merge conflict); would the following patch be okay? ext/spl/spl_fixedarray.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 4b3f0dcb80..cf4d371ade 100644
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -171,8 +171,20 @@ static void spl_fixedarray_resize(spl_fixedarray *array, zend_long size)
/* clearing the array */
if (size == 0) {
- spl_fixedarray_dtor(array);
- array->elements = NULL;
+ if (array->elements != NULL) {
+ zend_long i;
+ zval *elements = array->elements;
+
+ array->elements = NULL;
+ array->size = 0;
+
+ for (i = 0; i < array->size; i++) {
+ zval_ptr_dtor(&(elements[i]));
+ }
+
+ efree(elements);
+ return;
+ }
} else if (size > array->size) {
array->elements = safe_erealloc(array->elements, size, sizeof(zval), 0);
spl_fixedarray_init_elems(array, array->size, size);This would avoid calling php-src/ext/spl/spl_fixedarray.c Lines 150 to 157 in 6144524 |
TysonAndre
left a comment
TysonAndre
left a comment
There was a problem hiding this comment.
This PR should change array->size to size, see above comment
We actually need to destroy all elements.
That was due to an erroneous change. This should be fixed now, but there's still the question how to solve this in PHP-8.0+. |
I'd suggest updating spl_fixedarray_dtor to do the early elements/size reset. |
Thanks. Done. |
3 participants
We address the
::setSize(0)case by settingarray->element = NULLbefore we destroy the elements, and bail in this case out on re-entry
into
spl_fixedarray_resize().This is an alternative solution to PR #7485 based on @nikic's suggestion.