com php-src: Fixed a potential segfault in zend_objects_sto re_free_object_storage(): NEWS Zend/zend_gc .c

Commit: 5513f00a972d1781349035cc097971fb9056cce1 Author: Bob Weinand <bobwei9@hotmail.com> Wed, 27 Jul 2016 18:08:43 +0200 Parents: 23c359c27614a8b30afd860f2543912d1b297d08 Branches: PHP-7.0 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=5513f00a972d1781349035cc097971fb9056cce1 Log: Fixed a potential segfault in zend_objects_store_free_object_storage() Under the special circumstance where a garbage collected objects bucket slot was not reused until the end of the script, we get access into freed memory... No test added as it usually is valgrind-only, and only sometimes when the memory happens to have changed (i.e. (GC_FLAGS(obj) & IS_OBJ_FREE_CALLED) == 0), it actually *may* segfault Changed paths: M NEWS M Zend/zend_gc.c Diff: diff --git a/NEWS b/NEWS index abfb573..36f5f69 100644 --- a/NEWS +++ b/NEWS @@ -20,6 +20,8 @@ PHP NEWS phpize). (Yuji Uchiyama) . Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX). (Yuji Uchiyama) + . Fixed potential segfault in object storage freeing in shutdown sequence. + (Bob) - COM: . Fixed bug #72569 (DOTNET/COM array parameters broke in PHP7). (Anatol) diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c index 821ac4d..95be5d8 100644 --- a/Zend/zend_gc.c +++ b/Zend/zend_gc.c @@ -1097,6 +1097,7 @@ ZEND_API int zend_gc_collect_cycles(void) if (EG(objects_store).object_buckets && IS_OBJ_VALID(EG(objects_store).object_buckets[obj->handle])) { + EG(objects_store).object_buckets[obj->handle] = SET_OBJ_INVALID(obj); GC_TYPE(obj) = IS_NULL; if (!(GC_FLAGS(obj) & IS_OBJ_FREE_CALLED)) { GC_FLAGS(obj) |= IS_OBJ_FREE_CALLED;