File tree Expand file tree Collapse file tree 2 files changed +22
-1
lines changed Expand file tree Collapse file tree 2 files changed +22
-1
lines changed Original file line number Diff line number Diff line change @@ -11,6 +11,8 @@ PHP                                                                        NEWS
1111
1212- Opcache:
1313  . Fixed bug GH-20012 (heap buffer overflow in jit). (Arnaud)
14+   . Partially fixed bug GH-17733 (Avoid calling wrong function when reusing file
15+     caches across differing environments). (ilutov)
1416
1517- Reflection:
1618  . Fixed bug GH-20217 (ReflectionClass::isIterable() incorrectly returns true
Original file line number Diff line number Diff line change @@ -573,13 +573,32 @@ static void zend_file_cache_serialize_op_array(zend_op_array            *op_arra
573573			}
574574			if  (opline -> op2_type  ==  IS_CONST ) {
575575				SERIALIZE_PTR (opline -> op2 .zv );
576+ 
577+ 				/* See GH-17733. Reset Z_EXTRA_P(op2) of ZEND_INIT_FCALL, which 
578+ 				 * is an offset into the global function table, to avoid calling 
579+ 				 * incorrect functions when environment changes. This, and the 
580+ 				 * equivalent code below, can be removed once proper system ID 
581+ 				 * validation is implemented. */ 
582+ 				if  (opline -> opcode  ==  ZEND_INIT_FCALL ) {
583+ 					zval  * op2  =  opline -> op2 .zv ;
584+ 					UNSERIALIZE_PTR (op2 );
585+ 					Z_EXTRA_P (op2 ) =  0 ;
586+ 					ZEND_VM_SET_OPCODE_HANDLER (opline );
587+ 				}
576588			}
577589#else 
578590			if  (opline -> op1_type  ==  IS_CONST ) {
579591				opline -> op1 .constant  =  RT_CONSTANT (opline , opline -> op1 ) -  literals ;
580592			}
581593			if  (opline -> op2_type  ==  IS_CONST ) {
582- 				opline -> op2 .constant  =  RT_CONSTANT (opline , opline -> op2 ) -  literals ;
594+ 				zval  * op2  =  RT_CONSTANT (opline , opline -> op2 );
595+ 				opline -> op2 .constant  =  op2  -  literals ;
596+ 
597+ 				/* See GH-17733 and comment above. */ 
598+ 				if  (opline -> opcode  ==  ZEND_INIT_FCALL ) {
599+ 					Z_EXTRA_P (op2 ) =  0 ;
600+ 					ZEND_VM_SET_OPCODE_HANDLER (opline );
601+ 				}
583602			}
584603#endif 
585604#if  ZEND_USE_ABS_JMP_ADDR 
    
 
   
 
     
   
   
          
     
  
    
     
 
    
      
     
 
     
    You can’t perform that action at this time.
  
 
    
  
     
    
      
        
     
 
       
      
     
   
 
    
    
  
 
  
 
     
    
0 commit comments