Skip to content

Commit bfd9e0c

Browse files
nielsdosnielsdos
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Fix GH-16628: FPM logs are getting corrupted with this log statement Fix GH-16601: Memory leak in Reflection constructors
2 parents 9e2367f + 16cda10 commit bfd9e0c

11 files changed

+224
-13
lines changed

‎NEWS

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ PHP NEWS
1818
. Fixed bug GH-16593 (Assertion failure in DOM->replaceChild). (nielsdos)
1919
. Fixed bug GH-16595 (Another UAF in DOM -> cloneNode). (nielsdos)
2020

21+
- FPM:
22+
. Fixed bug GH-16628 (FPM logs are getting corrupted with this log
23+
statement). (nielsdos)
24+
2125
- GD:
2226
. Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
2327
(nielsdos)
@@ -37,6 +41,9 @@ PHP NEWS
3741
- PDO_ODBC:
3842
. Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values). (cmb)
3943

44+
- Reflection:
45+
. Fixed bug GH-16601 (Memory leak in Reflection constructors). (nielsdos)
46+
4047
- SPL:
4148
. Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos)
4249
. Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed

‎ext/reflection/php_reflection.c

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -225,18 +225,26 @@ static void _free_function(zend_function *fptr) /* {{{ */
225225
}
226226
/* }}} */
227227

228+
static void reflection_free_property_reference(property_reference *reference)
229+
{
230+
zend_string_release_ex(reference->unmangled_name, 0);
231+
efree(reference);
232+
}
233+
234+
static void reflection_free_parameter_reference(parameter_reference *reference)
235+
{
236+
_free_function(reference->fptr);
237+
efree(reference);
238+
}
239+
228240
static void reflection_free_objects_storage(zend_object *object) /* {{{ */
229241
{
230242
reflection_object *intern = reflection_object_from_obj(object);
231-
parameter_reference *reference;
232-
property_reference *prop_reference;
233243

234244
if (intern->ptr) {
235245
switch (intern->ref_type) {
236246
case REF_TYPE_PARAMETER:
237-
reference = (parameter_reference*)intern->ptr;
238-
_free_function(reference->fptr);
239-
efree(intern->ptr);
247+
reflection_free_parameter_reference(intern->ptr);
240248
break;
241249
case REF_TYPE_TYPE:
242250
{
@@ -251,9 +259,7 @@ static void reflection_free_objects_storage(zend_object *object) /* {{{ */
251259
_free_function(intern->ptr);
252260
break;
253261
case REF_TYPE_PROPERTY:
254-
prop_reference = (property_reference*)intern->ptr;
255-
zend_string_release_ex(prop_reference->unmangled_name, 0);
256-
efree(intern->ptr);
262+
reflection_free_property_reference(intern->ptr);
257263
break;
258264
case REF_TYPE_ATTRIBUTE: {
259265
attribute_reference *attr_ref = intern->ptr;
@@ -2585,6 +2591,10 @@ ZEND_METHOD(ReflectionParameter, __construct)
25852591
}
25862592
}
25872593

2594+
if (intern->ptr) {
2595+
reflection_free_parameter_reference(intern->ptr);
2596+
}
2597+
25882598
ref = (parameter_reference*) emalloc(sizeof(parameter_reference));
25892599
ref->arg_info = &arg_info[position];
25902600
ref->offset = (uint32_t)position;
@@ -2594,11 +2604,15 @@ ZEND_METHOD(ReflectionParameter, __construct)
25942604
intern->ptr = ref;
25952605
intern->ref_type = REF_TYPE_PARAMETER;
25962606
intern->ce = ce;
2607+
zval_ptr_dtor(&intern->obj);
25972608
if (reference && is_closure) {
25982609
ZVAL_COPY_VALUE(&intern->obj, reference);
2610+
} else {
2611+
ZVAL_UNDEF(&intern->obj);
25992612
}
26002613

26012614
prop_name = reflection_prop_name(object);
2615+
zval_ptr_dtor(prop_name);
26022616
if (has_internal_arg_info(fptr)) {
26032617
ZVAL_STRING(prop_name, ((zend_internal_arg_info*)arg_info)[position].name);
26042618
} else {
@@ -4129,10 +4143,12 @@ static void reflection_class_object_ctor(INTERNAL_FUNCTION_PARAMETERS, int is_ob
41294143
object = ZEND_THIS;
41304144
intern = Z_REFLECTION_P(object);
41314145

4146+
/* Note: class entry name is interned, no need to destroy them */
41324147
if (arg_obj) {
41334148
ZVAL_STR_COPY(reflection_prop_name(object), arg_obj->ce->name);
41344149
intern->ptr = arg_obj->ce;
41354150
if (is_object) {
4151+
zval_ptr_dtor(&intern->obj);
41364152
ZVAL_OBJ_COPY(&intern->obj, arg_obj);
41374153
}
41384154
} else {
@@ -5819,13 +5835,20 @@ ZEND_METHOD(ReflectionProperty, __construct)
58195835
}
58205836
}
58215837

5822-
ZVAL_STR_COPY(reflection_prop_name(object), name);
5838+
zval *prop_name = reflection_prop_name(object);
5839+
zval_ptr_dtor(prop_name);
5840+
ZVAL_STR_COPY(prop_name, name);
5841+
/* Note: class name are always interned, no need to destroy them */
58235842
if (dynam_prop == 0) {
58245843
ZVAL_STR_COPY(reflection_prop_class(object), property_info->ce->name);
58255844
} else {
58265845
ZVAL_STR_COPY(reflection_prop_class(object), ce->name);
58275846
}
58285847

5848+
if (intern->ptr) {
5849+
reflection_free_property_reference(intern->ptr);
5850+
}
5851+
58295852
reference = (property_reference*) emalloc(sizeof(property_reference));
58305853
reference->prop = dynam_prop ? NULL : property_info;
58315854
reference->unmangled_name = zend_string_copy(name);
@@ -6670,7 +6693,9 @@ ZEND_METHOD(ReflectionExtension, __construct)
66706693
RETURN_THROWS();
66716694
}
66726695
free_alloca(lcname, use_heap);
6673-
ZVAL_STRING(reflection_prop_name(object), module->name);
6696+
zval *prop_name = reflection_prop_name(object);
6697+
zval_ptr_dtor(prop_name);
6698+
ZVAL_STRING(prop_name, module->name);
66746699
intern->ptr = module;
66756700
intern->ref_type = REF_TYPE_OTHER;
66766701
intern->ce = NULL;

‎ext/reflection/tests/ReflectionExtension_double_construct.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
ReflectionExtension double construct call
3+
--FILE--
4+
<?php
5+
6+
$r = new ReflectionExtension('standard');
7+
var_dump($r);
8+
$r->__construct('standard');
9+
var_dump($r);
10+
11+
?>
12+
--EXPECT--
13+
object(ReflectionExtension)#1 (1) {
14+
["name"]=>
15+
string(8) "standard"
16+
}
17+
object(ReflectionExtension)#1 (1) {
18+
["name"]=>
19+
string(8) "standard"
20+
}

‎ext/reflection/tests/ReflectionObject_double_construct.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
ReflectionObject double construct call
3+
--FILE--
4+
<?php
5+
6+
$obj = new stdClass;
7+
$r = new ReflectionObject($obj);
8+
var_dump($r);
9+
$r->__construct($obj);
10+
var_dump($r);
11+
12+
?>
13+
--EXPECT--
14+
object(ReflectionObject)#2 (1) {
15+
["name"]=>
16+
string(8) "stdClass"
17+
}
18+
object(ReflectionObject)#2 (1) {
19+
["name"]=>
20+
string(8) "stdClass"
21+
}

‎ext/reflection/tests/ReflectionParameter_double_construct.phpt

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
--TEST--
2+
ReflectionParameter double construct call
3+
--FILE--
4+
<?php
5+
6+
$closure = function (int $x): void {};
7+
$r = new ReflectionParameter($closure, 'x');
8+
var_dump($r);
9+
$r->__construct($closure, 'x');
10+
var_dump($r);
11+
$r->__construct('ord', 'character');
12+
var_dump($r);
13+
14+
?>
15+
--EXPECT--
16+
object(ReflectionParameter)#2 (1) {
17+
["name"]=>
18+
string(1) "x"
19+
}
20+
object(ReflectionParameter)#2 (1) {
21+
["name"]=>
22+
string(1) "x"
23+
}
24+
object(ReflectionParameter)#2 (1) {
25+
["name"]=>
26+
string(9) "character"
27+
}

‎ext/reflection/tests/ReflectionProperty_double_construct.phpt

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
ReflectionProperty double construct call
3+
--FILE--
4+
<?php
5+
6+
$r = new ReflectionProperty(Exception::class, 'message');
7+
var_dump($r);
8+
$r->__construct(Exception::class, 'message');
9+
var_dump($r);
10+
11+
?>
12+
--EXPECT--
13+
object(ReflectionProperty)#1 (2) {
14+
["name"]=>
15+
string(7) "message"
16+
["class"]=>
17+
string(9) "Exception"
18+
}
19+
object(ReflectionProperty)#1 (2) {
20+
["name"]=>
21+
string(7) "message"
22+
["class"]=>
23+
string(9) "Exception"
24+
}

‎ext/zend_test/test.c

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -830,6 +830,17 @@ static ZEND_FUNCTION(zend_test_is_zend_ptr)
830830
RETURN_BOOL(is_zend_ptr((void*)addr));
831831
}
832832

833+
static ZEND_FUNCTION(zend_test_log_err_debug)
834+
{
835+
zend_string *str;
836+
837+
ZEND_PARSE_PARAMETERS_START(1, 1)
838+
Z_PARAM_STR(str);
839+
ZEND_PARSE_PARAMETERS_END();
840+
841+
php_log_err_with_severity(ZSTR_VAL(str), LOG_DEBUG);
842+
}
843+
833844
static zend_object *zend_test_class_new(zend_class_entry *class_type)
834845
{
835846
zend_object *obj = zend_objects_new(class_type);

‎ext/zend_test/test.stub.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,8 @@ function zend_test_set_fmode(bool $binary): void {}
307307
function zend_test_cast_fread($stream): void {}
308308

309309
function zend_test_is_zend_ptr(int $addr): bool {}
310+
311+
function zend_test_log_err_debug(string $str): void {}
310312
}
311313

312314
namespace ZendTestNS {

‎ext/zend_test/test_arginfo.h

Lines changed: 7 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sapi/fpm/fpm/zlog.c

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ static inline void zlog_external(
153153
}
154154
/* }}} */
155155

156+
/* Returns the length if the print were complete, this can be larger than buf_size. */
156157
static size_t zlog_buf_prefix(
157158
const char *function, int line, int flags,
158159
char *buf, size_t buf_size, int use_syslog) /* {{{ */
@@ -189,6 +190,7 @@ static size_t zlog_buf_prefix(
189190
}
190191
}
191192

193+
/* Important: snprintf returns the number of bytes if the print were complete. */
192194
return len;
193195
}
194196
/* }}} */
@@ -411,6 +413,7 @@ static inline ssize_t zlog_stream_unbuffered_write(
411413
static inline ssize_t zlog_stream_buf_copy_cstr(
412414
struct zlog_stream *stream, const char *str, size_t str_len) /* {{{ */
413415
{
416+
ZEND_ASSERT(stream->len <= stream->buf.size);
414417
if (stream->buf.size - stream->len <= str_len &&
415418
!zlog_stream_buf_alloc_ex(stream, str_len + stream->len)) {
416419
return -1;
@@ -425,6 +428,7 @@ static inline ssize_t zlog_stream_buf_copy_cstr(
425428

426429
static inline ssize_t zlog_stream_buf_copy_char(struct zlog_stream *stream, char c) /* {{{ */
427430
{
431+
ZEND_ASSERT(stream->len <= stream->buf.size);
428432
if (stream->buf.size - stream->len < 1 && !zlog_stream_buf_alloc_ex(stream, 1)) {
429433
return -1;
430434
}
@@ -681,6 +685,17 @@ ssize_t zlog_stream_prefix_ex(struct zlog_stream *stream, const char *function,
681685
len = zlog_buf_prefix(
682686
function, line, stream->flags,
683687
stream->buf.data, stream->buf.size, stream->use_syslog);
688+
if (!EXPECTED(len + 1 <= stream->buf.size)) {
689+
/* If the buffer was not large enough, try with a larger buffer.
690+
* Note that this may still truncate if the zlog_limit is reached. */
691+
len = MIN(len + 1, zlog_limit);
692+
if (!zlog_stream_buf_alloc_ex(stream, len)) {
693+
return -1;
694+
}
695+
zlog_buf_prefix(
696+
function, line, stream->flags,
697+
stream->buf.data, stream->buf.size, stream->use_syslog);
698+
}
684699
stream->len = stream->prefix_len = len;
685700
if (stream->msg_prefix != NULL) {
686701
zlog_stream_buf_copy_cstr(stream, stream->msg_prefix, stream->msg_prefix_len);
@@ -692,8 +707,8 @@ ssize_t zlog_stream_prefix_ex(struct zlog_stream *stream, const char *function,
692707
} else {
693708
char sbuf[1024];
694709
ssize_t written;
695-
len = zlog_buf_prefix(function, line, stream->flags, sbuf, 1024, stream->use_syslog);
696-
written = zlog_stream_direct_write(stream, sbuf, len);
710+
len = zlog_buf_prefix(function, line, stream->flags, sbuf, sizeof(sbuf), stream->use_syslog);
711+
written = zlog_stream_direct_write(stream, sbuf, MIN(len, sizeof(sbuf)));
697712
if (stream->msg_prefix != NULL) {
698713
written += zlog_stream_direct_write(
699714
stream, stream->msg_prefix, stream->msg_prefix_len);

0 commit comments

Comments
 (0)