Bug #78761 [Ver->Csd]: Zend memory heap corruption with preload and pointer casting

Edit report at https://bugs.php.net/bug.php?id=78761&edit=1 ID: 78761 Updated by: cmb@php.net Reported by: lisachenko dot it at gmail dot com Summary: Zend memory heap corruption with preload and pointer casting -Status: Verified +Status: Closed Type: Bug Package: *Extensibility Functions Operating System: Windows x64 PHP Version: 7.4.0RC4 Assigned To: cmb Block user comment: N Private report: N New Comment: Automatic comment on behalf of cmbecker69@gmx.de Revision: http://git.php.net/?p=php-src.git;a=commit;h=0055f1e3dc7ec27778d6d3bd22404319b3ceeeca Log: Fix #78761: Zend memory heap corruption with preload and casting Previous Comments: ------------------------------------------------------------------------ [2019-10-30 18:06:54] cmb@php.net The following pull request has been associated: Patch Name: Fix #78761: Zend memory heap corruption with preload and casting On GitHub: https://github.com/php/php-src/pull/4876 Patch: https://github.com/php/php-src/pull/4876.patch ------------------------------------------------------------------------ [2019-10-30 17:52:42] cmb@php.net I can confirm this issue. Simpler reproducer: <?php FFI::cast('char[10]', FFI::new('char[1]')); and opcache.preload=preload.php which is <?php FFI::load(__DIR__ . '/header.h'); header.h may be empty. The immediate problem seems to be that preloading sets FFI_G(persistent) to 1, but doesn't necessarily reset it to 0 when the loading is finished. This causes the array type to be allocated persistently, but it is later freed with efree(). ------------------------------------------------------------------------ [2019-10-30 11:28:04] lisachenko dot it at gmail dot com Description: ------------ There is a zend_mm_heap corruption when using FFI preload mode and proxying requests to the FFI::cast from a preloaded class. Corruptions appear when trying to cast any CData pointer to another type via preloaded class that wraps FFI::cast() internally. Test script: --------------- See gist: https://gist.github.com/lisachenko/f133184201aa3c63d58af9548bdd825a Expected result: ---------------- No memory corruption Actual result: -------------- Script terminated with zend_mm_heap corrupted ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78761&edit=1