mirror of
https://github.com/php/php-src.git
synced 2024-09-21 18:07:23 +00:00
ded8fb79bd
There are two related issues, each tested.
First problem:
What happens is that on the CLI SAPI we have a per-request pcre cache,
and on there the request shutdown for the pcre module happens prior to
the remaining live object destruction. So when the SPL object wants to
clean up the regular expression object it gets a use-after-free.
Second problem:
Very similarly, the non-persistent resources are destroyed after request
shutdown, so on the CLI SAPI the pcre request cache is already gone, but
if a userspace stream references a regex in the pcre cache, this breaks.
Two things that come immediately to mind:
- We could fix it by no longer treating the CLI SAPI special and just use
the same lifecycle as the module. This simplifies the pcre module code
a bit too. I wonder why we even have the separation in the first place.
The downside here is that we're using more the system allocator
than Zend's allocator for cache entries.
- We could modify the shutdown code to not remove regular expressions
with a refcount>0 and modify php_pcre_pce_decref code such that it
becomes php_pcre_pce_decref's job to clean up when the refcount
becomes 0 during shutdown. However, this gets nasty quickly.
I chose the first solution here as it should be reliable and simple.
Closes GH-15064.
|
||
|---|---|---|
| .. | ||
| jit | ||
| tests | ||
| config.m4 | ||
| config.w32 | ||
| CREDITS | ||
| opcache_arginfo.h | ||
| opcache.stub.php | ||
| shared_alloc_mmap.c | ||
| shared_alloc_posix.c | ||
| shared_alloc_shm.c | ||
| shared_alloc_win32.c | ||
| zend_accelerator_blacklist.c | ||
| zend_accelerator_blacklist.h | ||
| zend_accelerator_debug.c | ||
| zend_accelerator_debug.h | ||
| zend_accelerator_hash.c | ||
| zend_accelerator_hash.h | ||
| zend_accelerator_module.c | ||
| zend_accelerator_module.h | ||
| zend_accelerator_util_funcs.c | ||
| zend_accelerator_util_funcs.h | ||
| zend_file_cache.c | ||
| zend_file_cache.h | ||
| zend_persist_calc.c | ||
| zend_persist.c | ||
| zend_persist.h | ||
| zend_shared_alloc.c | ||
| zend_shared_alloc.h | ||
| ZendAccelerator.c | ||
| ZendAccelerator.h | ||