com php-src: Fixed possible crash because of race conditions on modifying constants in shared memory: Zend/zend_execute.c Zend/zend _vm_def.h
Zend/zend_vm_execute.h

Commit: 2330be5641c907b7edd7cffdd3074e85d0091df5 Author: Dmitry Stogov <dmitry@zend.com> Tue, 1 Jul 2014 00:13:34 +0400 Parents: 023d53fea5109aef3a1fc9ec7864b02ea1ec054c Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2330be5641c907b7edd7cffdd3074e85d0091df5 Log: Fixed possible crash because of race conditions on modifying constants in shared memory Changed paths: M Zend/zend_execute.c M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index ad92c5f..6ada04e 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -943,6 +943,26 @@ copy_value: } } +static void zval_deep_copy(zval **p) +{ + zval *value; + + ALLOC_ZVAL(value); + *value = **p; + if (Z_TYPE_P(value) == IS_ARRAY) { + HashTable *ht; + + ALLOC_HASHTABLE(ht); + zend_hash_init(ht, zend_hash_num_elements(Z_ARRVAL_P(value)), NULL, ZVAL_PTR_DTOR, 0); + zend_hash_copy(ht, Z_ARRVAL_P(value), (copy_ctor_func_t) zval_deep_copy, NULL, sizeof(zval *)); + Z_ARRVAL_P(value) = ht; + } else { + zval_copy_ctor(value); + } + INIT_PZVAL(value); + *p = value; +} + /* Utility Functions for Extensions */ static void zend_extension_statement_handler(const zend_extension *extension, zend_op_array *op_array TSRMLS_DC) { diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index cd7dbf4..c3fb86d 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -3422,6 +3422,13 @@ ZEND_VM_HANDLER(64, ZEND_RECV_INIT, ANY, CONST) if (IS_CONSTANT_TYPE(Z_TYPE_P(assignment_value))) { Z_SET_REFCOUNT_P(assignment_value, 1); zval_update_constant(&assignment_value, 0 TSRMLS_CC); + } else if (Z_TYPE_P(assignment_value) == IS_ARRAY) { + HashTable *ht; + + ALLOC_HASHTABLE(ht); + zend_hash_init(ht, zend_hash_num_elements(Z_ARRVAL_P(assignment_value)), NULL, ZVAL_PTR_DTOR, 0); + zend_hash_copy(ht, Z_ARRVAL_P(assignment_value), (copy_ctor_func_t) zval_deep_copy, NULL, sizeof(zval *)); + Z_ARRVAL_P(assignment_value) = ht; } else { zval_copy_ctor(assignment_value); } diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 29a8c0c..3fa94d1 100644 --- a/Zend/zend_vm_execute..h +++ b/Zend/zend_vm_execute.h @@ -1624,6 +1624,13 @@ static int ZEND_FASTCALL ZEND_RECV_INIT_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ if (IS_CONSTANT_TYPE(Z_TYPE_P(assignment_value))) { Z_SET_REFCOUNT_P(assignment_value, 1); zval_update_constant(&assignment_value, 0 TSRMLS_CC); + } else if (Z_TYPE_P(assignment_value) == IS_ARRAY) { + HashTable *ht; + + ALLOC_HASHTABLE(ht); + zend_hash_init(ht, zend_hash_num_elements(Z_ARRVAL_P(assignment_value)), NULL, ZVAL_PTR_DTOR, 0); + zend_hash_copy(ht, Z_ARRVAL_P(assignment_value), (copy_ctor_func_t) zval_deep_copy, NULL, sizeof(zval *)); + Z_ARRVAL_P(assignment_value) = ht; } else { zval_copy_ctor(assignment_value); }