Skip to content

Detect heap freelist corruption #14054

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Detect heap freelist corruption #14054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58cf127
Add zend_random_bytes(), zend_random_bytes_insecure() functions
arnaud-lb Jun 12, 2024
de40e69
Detect heap freelist corruption
arnaud-lb Jun 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions Zend/zend.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,8 @@ ZEND_API char *(*zend_getenv)(const char *name, size_t name_len);
ZEND_API zend_string *(*zend_resolve_path)(zend_string *filename);
ZEND_API zend_result (*zend_post_startup_cb)(void) = NULL;
ZEND_API void (*zend_post_shutdown_cb)(void) = NULL;
ZEND_ATTRIBUTE_NONNULL ZEND_API zend_result (*zend_random_bytes)(void *bytes, size_t size, char *errstr, size_t errstr_size) = NULL;
ZEND_ATTRIBUTE_NONNULL ZEND_API void (*zend_random_bytes_insecure)(zend_random_bytes_insecure_state *state, void *bytes, size_t size) = NULL;

/* This callback must be signal handler safe! */
void (*zend_on_timeout)(int seconds);
Expand Down Expand Up @@ -912,6 +914,11 @@ void zend_startup(zend_utility_functions *utility_functions) /* {{{ */
php_win32_cp_set_by_id(65001);
#endif

/* Set up early utility functions. zend_mm depends on
* zend_random_bytes_insecure */
zend_random_bytes = utility_functions->random_bytes_function;
zend_random_bytes_insecure = utility_functions->random_bytes_insecure_function;

start_memory_manager();

virtual_cwd_startup(); /* Could use shutdown to free the main cwd but it would just slow it down for CGI */
Expand Down
15 changes: 15 additions & 0 deletions Zend/zend.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,6 +234,11 @@ struct _zend_class_entry {
} info;
};

typedef union {
zend_max_align_t align;
uint64_t opaque[5];
} zend_random_bytes_insecure_state;

typedef struct _zend_utility_functions {
void (*error_function)(int type, zend_string *error_filename, const uint32_t error_lineno, zend_string *message);
size_t (*printf_function)(const char *format, ...) ZEND_ATTRIBUTE_PTR_FORMAT(printf, 1, 2);
Expand All @@ -248,6 +253,8 @@ typedef struct _zend_utility_functions {
void (*printf_to_smart_str_function)(smart_str *buf, const char *format, va_list ap);
char *(*getenv_function)(const char *name, size_t name_len);
zend_string *(*resolve_path_function)(zend_string *filename);
zend_result (*random_bytes_function)(void *bytes, size_t size, char *errstr, size_t errstr_size);
void (*random_bytes_insecure_function)(zend_random_bytes_insecure_state *state, void *bytes, size_t size);
} zend_utility_functions;

typedef struct _zend_utility_values {
Expand Down Expand Up @@ -340,6 +347,14 @@ extern void (*zend_printf_to_smart_string)(smart_string *buf, const char *format
extern void (*zend_printf_to_smart_str)(smart_str *buf, const char *format, va_list ap);
extern ZEND_API char *(*zend_getenv)(const char *name, size_t name_len);
extern ZEND_API zend_string *(*zend_resolve_path)(zend_string *filename);
/* Generate 'size' random bytes into 'bytes' with the OS CSPRNG. */
extern ZEND_ATTRIBUTE_NONNULL ZEND_API zend_result (*zend_random_bytes)(
void *bytes, size_t size, char *errstr, size_t errstr_size);
/* Generate 'size' random bytes into 'bytes' with a general purpose PRNG (not
* crypto safe). 'state' must be zeroed before the first call and can be reused.
*/
extern ZEND_ATTRIBUTE_NONNULL ZEND_API void (*zend_random_bytes_insecure)(
zend_random_bytes_insecure_state *state, void *bytes, size_t size);

/* These two callbacks are especially for opcache */
extern ZEND_API zend_result (*zend_post_startup_cb)(void);
Expand Down
Loading
Loading