Fix uouv on oom on object allocation #11739
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
01c123a to
ed70a67
Compare
|
Well apparently the compilers are not happy: |
|
It's missing a |
Initialize object.handlers to std_object_handlers in zend_object_alloc. This avoids a use-after-free for objects using custom handlers that are installed after allocation, accessing the handlers on shutdown when they haven't been set yet. Fixes phpGH-11734
dstogov
reviewed
Jul 31, 2023
| * installed. This avoids a use-of-uninitialized-value on shutdown. This would be more fitting in | ||
| * zend_object_std_init(), but some extensions set handlers before calling | ||
| * zend_object_std_init(). */ | ||
| ((zend_object *)((uintptr_t)obj + obj_size - sizeof(zend_object)))->handlers = &std_object_handlers; |
There was a problem hiding this comment.
I think, this is completely wrong. std_object_handlers->offset is zero and this may be inconsistent with the real obj_size. This is wrong for SplPriorityQueue.
Do I miss something?
There was a problem hiding this comment.
Oh. I was completely unaware of this field... I'll look for a case-by-case solution then. All objects must set handlers before allocating with emalloc.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Initialize object.handlers to std_object_handlers in zend_object_alloc. This avoids a use-after-free for objects using custom handlers that are installed after allocation, accessing the handlers on shutdown when they haven't been set yet.
Fixes GH-11734