Skip to content

Commit 6e45add

Browse files
committed
Fix changin get_iterator pointer with aslr
1 parent 33428b6 commit 6e45add

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

ext/opcache/zend_file_cache.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,8 @@ static int zend_file_cache_flock(int fd, int type)
186186
} \
187187
} while (0)
188188

189+
#define HOOKED_ITERATOR_PLACEHOLDER ((void*)1)
190+
189191
static const uint32_t uninitialized_bucket[-HT_MIN_MASK] =
190192
{HT_INVALID_IDX, HT_INVALID_IDX};
191193

@@ -903,6 +905,11 @@ static void zend_file_cache_serialize_class(zval *zv,
903905
ZEND_MAP_PTR_INIT(ce->mutable_data, NULL);
904906

905907
ce->inheritance_cache = NULL;
908+
909+
if (ce->get_iterator) {
910+
ZEND_ASSERT(ce->get_iterator == zend_hooked_object_get_iterator);
911+
ce->get_iterator = HOOKED_ITERATOR_PLACEHOLDER;
912+
}
906913
}
907914

908915
static void zend_file_cache_serialize_warnings(
@@ -1751,6 +1758,11 @@ static void zend_file_cache_unserialize_class(zval *zv,
17511758
ZEND_MAP_PTR_INIT(ce->static_members_table, NULL);
17521759
}
17531760

1761+
if (ce->get_iterator) {
1762+
ZEND_ASSERT(ce->get_iterator == HOOKED_ITERATOR_PLACEHOLDER);
1763+
ce->get_iterator = zend_hooked_object_get_iterator;
1764+
}
1765+
17541766
// Memory addresses of object handlers are not stable. They can change due to ASLR or order of linking dynamic. To
17551767
// avoid pointing to invalid memory we relink default_object_handlers here.
17561768
ce->default_object_handlers = ce->ce_flags & ZEND_ACC_ENUM ? &zend_enum_object_handlers : &std_object_handlers;

0 commit comments

Comments
 (0)