File tree Expand file tree Collapse file tree 2 files changed +22
-1
lines changed Expand file tree Collapse file tree 2 files changed +22
-1
lines changed Original file line number Diff line number Diff line change @@ -11,6 +11,8 @@ PHP NEWS
1111
1212- Opcache:
1313 . Fixed bug GH-20012 (heap buffer overflow in jit). (Arnaud)
14+ . Partially fixed bug GH-17733 (Avoid calling wrong function when reusing file
15+ caches across differing environments). (ilutov)
1416
1517- Reflection:
1618 . Fixed bug GH-20217 (ReflectionClass::isIterable() incorrectly returns true
Original file line number Diff line number Diff line change @@ -573,13 +573,32 @@ static void zend_file_cache_serialize_op_array(zend_op_array *op_arra
573573 }
574574 if (opline -> op2_type == IS_CONST ) {
575575 SERIALIZE_PTR (opline -> op2 .zv );
576+
577+ /* See GH-17733. Reset Z_EXTRA_P(op2) of ZEND_INIT_FCALL, which
578+ * is an offset into the global function table, to avoid calling
579+ * incorrect functions when environment changes. This, and the
580+ * equivalent code below, can be removed once proper system ID
581+ * validation is implemented. */
582+ if (opline -> opcode == ZEND_INIT_FCALL ) {
583+ zval * op2 = opline -> op2 .zv ;
584+ UNSERIALIZE_PTR (op2 );
585+ Z_EXTRA_P (op2 ) = 0 ;
586+ ZEND_VM_SET_OPCODE_HANDLER (opline );
587+ }
576588 }
577589#else
578590 if (opline -> op1_type == IS_CONST ) {
579591 opline -> op1 .constant = RT_CONSTANT (opline , opline -> op1 ) - literals ;
580592 }
581593 if (opline -> op2_type == IS_CONST ) {
582- opline -> op2 .constant = RT_CONSTANT (opline , opline -> op2 ) - literals ;
594+ zval * op2 = RT_CONSTANT (opline , opline -> op2 );
595+ opline -> op2 .constant = op2 - literals ;
596+
597+ /* See GH-17733 and comment above. */
598+ if (opline -> opcode == ZEND_INIT_FCALL ) {
599+ Z_EXTRA_P (op2 ) = 0 ;
600+ ZEND_VM_SET_OPCODE_HANDLER (opline );
601+ }
583602 }
584603#endif
585604#if ZEND_USE_ABS_JMP_ADDR
You can’t perform that action at this time.
0 commit comments