Skip to content

Commit ec8a24f

Browse files
authored
Fix phpGH-16397: Segmentation fault when comparing FFI object (php#16401)
`compare` is a required handler [1], but this handler was set to NULL. Throw an exception when trying to compare FFI objects. [1] https://github.com/php/php-src/blob/35c8a010c6633a2a1ba7c16a0cf83affa07b819e/Zend/zend_object_handlers.h#L231C1-L231C64 Closes phpGH-16401.
1 parent 5955ce8 commit ec8a24f

File tree

3 files changed

+26
-1
lines changed

3 files changed

+26
-1
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ PHP NEWS
2525
. Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a
2626
real file). (nielsdos, cmb)
2727

28+
- FFI:
29+
. Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
30+
(nielsdos)
31+
2832
- GD:
2933
. Fixed bug GH-16334 (imageaffine overflow on matrix elements).
3034
(David Carlier)

ext/ffi/ffi.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2922,6 +2922,12 @@ static zend_function *zend_ffi_get_func(zend_object **obj, zend_string *name, co
29222922
}
29232923
/* }}} */
29242924

2925+
static int zend_fake_compare_objects(zval *o1, zval *o2)
2926+
{
2927+
zend_throw_error(zend_ffi_exception_ce, "Cannot compare FFI objects");
2928+
return ZEND_UNCOMPARABLE;
2929+
}
2930+
29252931
static zend_never_inline int zend_ffi_disabled(void) /* {{{ */
29262932
{
29272933
zend_throw_error(zend_ffi_exception_ce, "FFI API is restricted by \"ffi.enable\" configuration directive");
@@ -5367,7 +5373,7 @@ ZEND_MINIT_FUNCTION(ffi)
53675373
zend_ffi_handlers.has_dimension = zend_fake_has_dimension;
53685374
zend_ffi_handlers.unset_dimension = zend_fake_unset_dimension;
53695375
zend_ffi_handlers.get_method = zend_ffi_get_func;
5370-
zend_ffi_handlers.compare = NULL;
5376+
zend_ffi_handlers.compare = zend_fake_compare_objects;
53715377
zend_ffi_handlers.cast_object = zend_fake_cast_object;
53725378
zend_ffi_handlers.get_debug_info = NULL;
53735379
zend_ffi_handlers.get_closure = NULL;

ext/ffi/tests/gh16397.phpt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
GH-16397 (Segmentation fault when comparing FFI object)
3+
--EXTENSIONS--
4+
ffi
5+
--FILE--
6+
<?php
7+
$ffi = FFI::cdef();
8+
try {
9+
var_dump($ffi != 1);
10+
} catch (FFI\Exception $e) {
11+
echo $e->getMessage(), "\n";
12+
}
13+
?>
14+
--EXPECT--
15+
Cannot compare FFI objects

0 commit comments

Comments
 (0)