Bug #78488 [NEW]: OOB in ZEND_FUNCTION(ffi_trampoline)

From: cmb Operating system: Windows x86 PHP version: 7.4Git-2019-09-03 (Git) Package: Unknown/Other Function Bug Type: Bug Bug description:OOB in ZEND_FUNCTION(ffi_trampoline) Description: ------------ As of commit 77a0fa1[1], x86 Windows debug builds signal stack memory corruption in ZEND_FUNCTION(ffi_trampoline) when running callconv.phpt. The culprit is that we're allocating not enough space[2], since FFI_SIZEOF_ARG is 4 on x86 Windows, but in zend_ffi_pass_arg() we're copying doubles (and perhaps even wider values) to that memory. I'm somewhat confused to have a constant for the argument size, since at least some call conventions do not have a fixed argument size to my knowledge, but at least here we must not use this constant, but rather the maximum size of the supported argument types. [1] <http://git.php.net/?p=php-src.git;a=commit;h=77a0fa101ed59f05ea07b03adb1cb66962fc45e7> [2] <https://github.com/php/php-src/blob/php-7.4.0beta4/ext/ffi/ffi.c#L2616-L2617> -- Edit bug report at https://bugs.php.net/bug.php?id=78488&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78488&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78488&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78488&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78488&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78488&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78488&r=support Expected behavior: https://bugs.php.net/fix.php?id=78488&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78488&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78488&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78488&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78488&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78488&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78488&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78488&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78488&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78488&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78488&r=mysqlcfg