archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source 
* PHP-8.4:
  Fix GH-17938: UAF with zend_test opline observer and magic_quotes_gpc=1 (#17958)
This commit is contained in:
Niels Dossche 2025-03-03 08:22:55 +01:00
commit 0097ad8eb3
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
ext/zend_test/test.c
View file

@ -697,6 +697,15 @@ void * zend_test_custom_realloc(void * ptr, size_t len ZEND_FILE_LINE_DC ZEND_FI
return _zend_mm_realloc(ZT_G(zend_orig_heap), ptr, len ZEND_FILE_LINE_EMPTY_CC ZEND_FILE_LINE_EMPTY_CC); return _zend_mm_realloc(ZT_G(zend_orig_heap), ptr, len ZEND_FILE_LINE_EMPTY_CC ZEND_FILE_LINE_EMPTY_CC);
} }
static void zend_test_reset_heap(zend_zend_test_globals *zend_test_globals)
{
if (zend_test_globals->zend_test_heap) {
free(zend_test_globals->zend_test_heap);
zend_test_globals->zend_test_heap = NULL;
zend_mm_set_heap(zend_test_globals->zend_orig_heap);
}
}
static PHP_INI_MH(OnUpdateZendTestObserveOplineInZendMM) static PHP_INI_MH(OnUpdateZendTestObserveOplineInZendMM)
{ {
if (new_value == NULL) { if (new_value == NULL) {
@ -718,10 +727,8 @@ static PHP_INI_MH(OnUpdateZendTestObserveOplineInZendMM)
); );
ZT_G(zend_orig_heap) = zend_mm_get_heap(); ZT_G(zend_orig_heap) = zend_mm_get_heap();
zend_mm_set_heap(ZT_G(zend_test_heap)); zend_mm_set_heap(ZT_G(zend_test_heap));
} else if (ZT_G(zend_test_heap)) { } else {
free(ZT_G(zend_test_heap)); zend_test_reset_heap(ZEND_MODULE_GLOBALS_BULK(zend_test));
ZT_G(zend_test_heap) = NULL;
zend_mm_set_heap(ZT_G(zend_orig_heap));
} }
return OnUpdateBool(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage); return OnUpdateBool(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
} }
@ -1387,6 +1394,7 @@ static PHP_GINIT_FUNCTION(zend_test)
static PHP_GSHUTDOWN_FUNCTION(zend_test) static PHP_GSHUTDOWN_FUNCTION(zend_test)
{ {
zend_test_observer_gshutdown(zend_test_globals); zend_test_observer_gshutdown(zend_test_globals);
zend_test_reset_heap(zend_test_globals);
} }
PHP_MINFO_FUNCTION(zend_test) PHP_MINFO_FUNCTION(zend_test)