Skip to content

Commit 0cecf83

Browse files
committed
Fix #79040: Warning Opcode handlers are unusable due to ASLR
We must not use the same shared memory OPcache instance for different SAPIs, since their memory layout is different. To avoid this, we add the SAPI name (truncated to at most 20 characters) to the names of the memory base file, the mutex and the file mapping.
1 parent 1aa419d commit 0cecf83

File tree

2 files changed

+8
-4
lines changed

2 files changed

+8
-4
lines changed

NEWS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ PHP NEWS
2121
- Libxml:
2222
. Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence)
2323

24+
- OPcache:
25+
. Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR). (cmb)
26+
2427
- Pcntl:
2528
. Fixed bug #78402 (Converting null to string in error message is bad DX).
2629
(SATŌ Kentarō)

ext/opcache/shared_alloc_win32.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include "zend_shared_alloc.h"
2424
#include "zend_accelerator_util_funcs.h"
2525
#include "zend_execute.h"
26+
#include "SAPI.h"
2627
#include "tsrm_win32.h"
2728
#include <winbase.h>
2829
#include <process.h>
@@ -78,14 +79,14 @@ static void zend_win_error_message(int type, char *msg, int err)
7879

7980
static char *create_name_with_username(char *name)
8081
{
81-
static char newname[MAXPATHLEN + UNLEN + 4 + 1 + 32];
82+
static char newname[MAXPATHLEN + UNLEN + 4 + 1 + 32 + 21];
8283
char *uname;
8384

8485
uname = php_win32_get_username();
8586
if (!uname) {
8687
return NULL;
8788
}
88-
snprintf(newname, sizeof(newname) - 1, "%s@%s@%.32s", name, uname, ZCG(system_id));
89+
snprintf(newname, sizeof(newname) - 1, "%s@%s@%.20s@%.32s", name, uname, sapi_module.name, ZCG(system_id));
8990

9091
free(uname);
9192

@@ -94,7 +95,7 @@ static char *create_name_with_username(char *name)
9495

9596
static char *get_mmap_base_file(void)
9697
{
97-
static char windir[MAXPATHLEN+UNLEN + 3 + sizeof("\\\\@") + 1 + 32];
98+
static char windir[MAXPATHLEN+UNLEN + 3 + sizeof("\\\\@") + 1 + 32 + 21];
9899
char *uname;
99100
int l;
100101

@@ -107,7 +108,7 @@ static char *get_mmap_base_file(void)
107108
if ('\\' == windir[l-1]) {
108109
l--;
109110
}
110-
snprintf(windir + l, sizeof(windir) - l - 1, "\\%s@%s@%.32s", ACCEL_FILEMAP_BASE, uname, ZCG(system_id));
111+
snprintf(windir + l, sizeof(windir) - l - 1, "\\%s@%s@%.20s@%.32s", ACCEL_FILEMAP_BASE, uname, sapi_module.name, ZCG(system_id));
111112

112113
free(uname);
113114

0 commit comments

Comments
 (0)