Conversation
…tructions with callable conversion Call level counter was broken: ZEND_CALLABLE_CONVERT was forgotten.
LamentXU123
left a comment
LamentXU123
left a comment
There was a problem hiding this comment.
3 line of php to cause memory bugs. New record.
This looks good as I tried to make sense of the code here as a newcomer to opcache.
| --TEST-- | ||
| OSS-Fuzz #546798343 (Heap-buffer-overflow in zend_delete_call_instructions with callable conversion) | ||
| --EXTENSIONS-- | ||
| opcache |
There was a problem hiding this comment.
without the opcache.enable_cli it runs only on CI right ?
There was a problem hiding this comment.
Yeah I'll add the opcache INIs
| case ZEND_DO_ICALL: | ||
| case ZEND_DO_UCALL: | ||
| case ZEND_DO_FCALL_BY_NAME: | ||
| case ZEND_CALLABLE_CONVERT: |
There was a problem hiding this comment.
outside of this PR perview of course, but is it me or is it missing in zend opcode too (and _PARTIAL as well) ?
There was a problem hiding this comment.
I didn't understand what you meant with "missing in zend opcode"?
Also yes, on master this also needs ZEND_CALLABLE_CONVERT_PARTIAL, but that opcode only exists on master
There was a problem hiding this comment.
ah yes I did not realise it was 8.4 .. so I meant Zend/zend_opcode.c line ~829 (master). But again, maybe I misread.
There was a problem hiding this comment.
That looks like the handling for the NEW opcode, but you can't make an FCC callable (or PFA) for the new invocation. I.e. this is not possible: $closure = new Foo(...);.
So that code should be fine.
|
Done the INI in the merge, and done the PFA fix in master during merge. |
3 participants
…tructions with callable conversion
Call level counter was broken: ZEND_CALLABLE_CONVERT was forgotten.
Note for master: needs ZEND_CALLABLE_CONVERT_PARTIAL too!