Fix GH-8556: FFI\CData use-after-free after FFI object destroyed #10574
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes phpGH-8556 The return type from a ffi trampoline was just copied over without taking into account that the cdata may outlive the cdef. Fix it in the same way that others have fixed it: by using the zend_ffi_remember_type function. This by itself was not enough. The FFI::cdef function sets the default type attr to ZEND_FFI_ATTR_STORED, but the type isn't actually stored into the weak_types hashtable. This causes the lifetime management code to mistakenly think it is already in the table and therefore leads to use after frees. Fix it by changing the default flags to 0.
dstogov
reviewed
Feb 13, 2023
Comment on lines
-2922
to
+2932
| FFI_G(default_type_attr) = ZEND_FFI_ATTR_STORED; | ||
| FFI_G(default_type_attr) = 0; |
There was a problem hiding this comment.
I afraid this was a design decision - cdef should relive all CData objects. Otherwise almost any type has to be remembered. The problem is not limited to return type, but to any declared type.
<?php
$cdef = FFI::cdef("typedef int T[5];");
$a = $cdef->new("T");
var_dump($a);
unset($cdef);
var_dump($a);It would be great to find a common efficient solution. Fixing this only for return type doesn't make a lot of sense.
I would agree to merge this fix only for return type without this s/ZEND_FFI_ATTR_STORED/0/ hunk.
There was a problem hiding this comment.
Oh I see, thanks for checking. I'll see later this week if I can come up with something.
There was a problem hiding this comment.
Thanks for looking into this :)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes GH-8556
The return type from a ffi trampoline was just copied over without taking into account that the cdata may outlive the cdef. Fix it in the same way that others have fixed it: by using the zend_ffi_remember_type function.
This by itself was not enough. The FFI::cdef function sets the default type attr to ZEND_FFI_ATTR_STORED, but the type isn't actually stored into the weak_types hashtable. This causes the lifetime management code to mistakenly think it is already in the table and therefore leads to use after frees. Fix it by changing the default flags to 0.