Fix bug #79643: Invalid memory read when opcache.interned_strings_buffer is 0

Author: twose

NEWS

@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug #64076 (imap_sort() does not return FALSE on failure). (cmb)
   . Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb)
 
+- Opcache:
+  . Fixed bug #79643 (PHP with Opcache crashes when a file with specific name
+    is included). (twosee)
+
 - OpenSSL:
   . Fixed bug #79983 (openssl_encrypt / openssl_decrypt fail with OCB mode).
     (Nikita)

ext/opcache/ZendAccelerator.c

@@ -2576,7 +2576,9 @@ static int zend_accel_init_shm(void)
 	if (ZCG(accel_directives).interned_strings_buffer) {
 		accel_shared_globals = zend_shared_alloc((ZCG(accel_directives).interned_strings_buffer * 1024 * 1024));
 	} else {
-		accel_shared_globals = zend_shared_alloc(sizeof(zend_accel_shared_globals));
+		/* Make sure there is always at least one interned string hash slot,
+		 * so the table can be queried unconditionally. */
+		accel_shared_globals = zend_shared_alloc(sizeof(zend_accel_shared_globals) + sizeof(uint32_t));
 	}
 	if (!accel_shared_globals) {
 		zend_accel_error(ACCEL_LOG_FATAL, "Insufficient shared memory!");
@@ -2617,6 +2619,8 @@ static int zend_accel_init_shm(void)
 			STRTAB_INVALID_POS,
 			(char*)ZCSG(interned_strings).start -
 				((char*)&ZCSG(interned_strings) + sizeof(zend_string_table)));
+	} else {
+		*STRTAB_HASH_TO_SLOT(&ZCSG(interned_strings), 0) = STRTAB_INVALID_POS;
 	}
 
 	zend_interned_strings_set_request_storage_handlers(accel_new_interned_string_for_php, accel_init_interned_string_for_php);