Bug #78761 [PATCH]: Zend memory heap corruption with preload and pointer casting

Edit report at https://bugs.php.net/bug.php?id=78761&edit=1 ID: 78761 Patch added by: cmb@php.net Reported by: lisachenko dot it at gmail dot com Summary: Zend memory heap corruption with preload and pointer casting Status: Verified Type: Bug Package: *Extensibility Functions Operating System: Windows x64 PHP Version: 7.4.0RC4 Assigned To: cmb Block user comment: N Private report: N New Comment: The following pull request has been associated: Patch Name: Fix #78761: Zend memory heap corruption with preload and casting On GitHub: https://github.com/php/php-src/pull/4876 Patch: https://github.com/php/php-src/pull/4876.patch Previous Comments: ------------------------------------------------------------------------ [2019-10-30 17:52:42] cmb@php.net I can confirm this issue. Simpler reproducer: <?php FFI::cast('char[10]', FFI::new('char[1]')); and opcache.preload=preload.php which is <?php FFI::load(__DIR__ . '/header.h'); header.h may be empty. The immediate problem seems to be that preloading sets FFI_G(persistent) to 1, but doesn't necessarily reset it to 0 when the loading is finished. This causes the array type to be allocated persistently, but it is later freed with efree(). ------------------------------------------------------------------------ [2019-10-30 11:28:04] lisachenko dot it at gmail dot com Description: ------------ There is a zend_mm_heap corruption when using FFI preload mode and proxying requests to the FFI::cast from a preloaded class. Corruptions appear when trying to cast any CData pointer to another type via preloaded class that wraps FFI::cast() internally. Test script: --------------- See gist: https://gist.github.com/lisachenko/f133184201aa3c63d58af9548bdd825a Expected result: ---------------- No memory corruption Actual result: -------------- Script terminated with zend_mm_heap corrupted ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78761&edit=1