Skip to content

Detect misuse of ZEND_MAP_PTR_NEW() #16468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Detect misuse of ZEND_MAP_PTR_NEW() #16468

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
00f6ac5
Detect misuse of ZEND_MAP_PTR_NEW()
arnaud-lb Oct 16, 2024
bfa3f9d
Review
arnaud-lb Oct 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions Zend/zend.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -737,6 +737,9 @@ static void compiler_globals_ctor(zend_compiler_globals *compiler_globals) /* {{
compiler_globals->map_ptr_base = ZEND_MAP_PTR_BIASED_BASE(NULL);
compiler_globals->map_ptr_size = 0;
compiler_globals->map_ptr_last = global_map_ptr_last;
#if ZEND_DEBUG
compiler_globals->map_ptr_protected = true;
#endif
compiler_globals->internal_run_time_cache = NULL;
if (compiler_globals->map_ptr_last || zend_map_ptr_static_size) {
/* Allocate map_ptr table */
Expand Down Expand Up @@ -788,6 +791,9 @@ static void compiler_globals_dtor(zend_compiler_globals *compiler_globals) /* {{
compiler_globals->map_ptr_real_base = NULL;
compiler_globals->map_ptr_base = ZEND_MAP_PTR_BIASED_BASE(NULL);
compiler_globals->map_ptr_size = 0;
#if ZEND_DEBUG
compiler_globals->map_ptr_protected = true;
#endif
}
if (compiler_globals->internal_run_time_cache) {
pefree(compiler_globals->internal_run_time_cache, 1);
Expand Down Expand Up @@ -1033,6 +1039,10 @@ void zend_startup(zend_utility_functions *utility_functions) /* {{{ */

zend_hash_destroy(executor_globals->zend_constants);
*executor_globals->zend_constants = *GLOBAL_CONSTANTS_TABLE;

# if ZEND_DEBUG
compiler_globals->map_ptr_protected = false;
# endif
#else
ini_scanner_globals_ctor(&ini_scanner_globals);
php_scanner_globals_ctor(&language_scanner_globals);
Expand All @@ -1045,6 +1055,9 @@ void zend_startup(zend_utility_functions *utility_functions) /* {{{ */
CG(map_ptr_base) = ZEND_MAP_PTR_BIASED_BASE(NULL);
CG(map_ptr_size) = 0;
CG(map_ptr_last) = 0;
# if ZEND_DEBUG
CG(map_ptr_protected) = false;
# endif
#endif /* ZTS */
EG(error_reporting) = E_ALL & ~E_NOTICE;

Expand Down Expand Up @@ -1124,6 +1137,9 @@ zend_result zend_post_startup(void) /* {{{ */
}
compiler_globals->map_ptr_real_base = NULL;
compiler_globals->map_ptr_base = ZEND_MAP_PTR_BIASED_BASE(NULL);
# if ZEND_DEBUG
compiler_globals->map_ptr_protected = true;
# endif
if (compiler_globals->internal_run_time_cache) {
pefree(compiler_globals->internal_run_time_cache, 1);
}
Expand All @@ -1142,6 +1158,9 @@ zend_result zend_post_startup(void) /* {{{ */
zend_copy_ini_directives();
#else
global_map_ptr_last = CG(map_ptr_last);
# if ZEND_DEBUG
CG(map_ptr_protected) = true;
# endif
#endif

#ifdef ZEND_CHECK_STACK_LIMIT
Expand Down Expand Up @@ -1204,6 +1223,9 @@ void zend_shutdown(void) /* {{{ */
CG(map_ptr_real_base) = NULL;
CG(map_ptr_base) = ZEND_MAP_PTR_BIASED_BASE(NULL);
CG(map_ptr_size) = 0;
# if ZEND_DEBUG
CG(map_ptr_protected) = true;
# endif
}
if (CG(script_encoding_list)) {
free(ZEND_VOIDP(CG(script_encoding_list)));
Expand Down Expand Up @@ -2011,6 +2033,10 @@ ZEND_API void *zend_map_ptr_new(void)
{
void **ptr;

#if ZEND_DEBUG
ZEND_ASSERT(!CG(map_ptr_protected) && "Can not allocate map ptrs after startup");
#endif

if (CG(map_ptr_last) >= CG(map_ptr_size)) {
/* Grow map_ptr table */
CG(map_ptr_size) = ZEND_MM_ALIGNED_SIZE_EX(CG(map_ptr_last) + 1, 4096);
Expand All @@ -2027,6 +2053,10 @@ ZEND_API void *zend_map_ptr_new_static(void)
{
void **ptr;

#if ZEND_DEBUG
ZEND_ASSERT(!startup_done && "Can not allocate static map ptrs after startup");
#endif

if (zend_map_ptr_static_last >= zend_map_ptr_static_size) {
zend_map_ptr_static_size += 4096;
/* Grow map_ptr table */
Expand Down Expand Up @@ -2078,11 +2108,21 @@ ZEND_API void zend_alloc_ce_cache(zend_string *type_name)
return;
}

#if ZEND_DEBUG
/* This use of ZEND_MAP_PTR_NEW_OFFSET() is safe */
bool orig_map_ptr_protected = CG(map_ptr_protected);
CG(map_ptr_protected) = false;
#endif

/* We use the refcount to keep map_ptr of corresponding type */
uint32_t ret;
do {
ret = ZEND_MAP_PTR_NEW_OFFSET();
} while (ret <= 2);
GC_ADD_FLAGS(type_name, IS_STR_CLASS_NAME_MAP_PTR);
GC_SET_REFCOUNT(type_name, ret);

#if ZEND_DEBUG
CG(map_ptr_protected) = orig_map_ptr_protected;
#endif
}
3 changes: 3 additions & 0 deletions Zend/zend_globals.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,9 @@ struct _zend_compiler_globals {
void *map_ptr_base;
size_t map_ptr_size;
size_t map_ptr_last;
#if ZEND_DEBUG
bool map_ptr_protected;
#endif

HashTable *delayed_variance_obligations;
HashTable *delayed_autoloads;
Expand Down
6 changes: 6 additions & 0 deletions ext/opcache/zend_shared_alloc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -515,6 +515,9 @@ void zend_shared_alloc_lock(void)
#endif

ZCG(locked) = 1;
#if ZEND_DEBUG
CG(map_ptr_protected) = false;
#endif
}

void zend_shared_alloc_unlock(void)
Expand All @@ -530,6 +533,9 @@ void zend_shared_alloc_unlock(void)
mem_write_unlock.l_len = 1;
#endif

#if ZEND_DEBUG
CG(map_ptr_protected) = true;
#endif
ZCG(locked) = 0;

#ifndef ZEND_WIN32
Expand Down