Skip to content

Commit ab0a915

Browse files
committed
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4: Reset Z_EXTRA_P(op2) of ZEND_INIT_FCALL for opcache file cache
2 parents 80a6adc + 50c7f49 commit ab0a915

File tree

2 files changed

+22
-1
lines changed

2 files changed

+22
-1
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ PHP NEWS
1111

1212
- Opcache:
1313
. Fixed bug GH-20012 (heap buffer overflow in jit). (Arnaud)
14+
. Partially fixed bug GH-17733 (Avoid calling wrong function when reusing file
15+
caches across differing environments). (ilutov)
1416

1517
- Reflection:
1618
. Fixed bug GH-20217 (ReflectionClass::isIterable() incorrectly returns true

ext/opcache/zend_file_cache.c

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -573,13 +573,32 @@ static void zend_file_cache_serialize_op_array(zend_op_array *op_arra
573573
}
574574
if (opline->op2_type == IS_CONST) {
575575
SERIALIZE_PTR(opline->op2.zv);
576+
577+
/* See GH-17733. Reset Z_EXTRA_P(op2) of ZEND_INIT_FCALL, which
578+
* is an offset into the global function table, to avoid calling
579+
* incorrect functions when environment changes. This, and the
580+
* equivalent code below, can be removed once proper system ID
581+
* validation is implemented. */
582+
if (opline->opcode == ZEND_INIT_FCALL) {
583+
zval *op2 = opline->op2.zv;
584+
UNSERIALIZE_PTR(op2);
585+
Z_EXTRA_P(op2) = 0;
586+
ZEND_VM_SET_OPCODE_HANDLER(opline);
587+
}
576588
}
577589
#else
578590
if (opline->op1_type == IS_CONST) {
579591
opline->op1.constant = RT_CONSTANT(opline, opline->op1) - literals;
580592
}
581593
if (opline->op2_type == IS_CONST) {
582-
opline->op2.constant = RT_CONSTANT(opline, opline->op2) - literals;
594+
zval *op2 = RT_CONSTANT(opline, opline->op2);
595+
opline->op2.constant = op2 - literals;
596+
597+
/* See GH-17733 and comment above. */
598+
if (opline->opcode == ZEND_INIT_FCALL) {
599+
Z_EXTRA_P(op2) = 0;
600+
ZEND_VM_SET_OPCODE_HANDLER(opline);
601+
}
583602
}
584603
#endif
585604
#if ZEND_USE_ABS_JMP_ADDR

0 commit comments

Comments
 (0)