Merge branch 'PHP-8.1'

nikic · nikic · commit ccff3d93c3eb · 2021-09-14T12:03:22.000+02:00
* PHP-8.1:
  Fix func/class name use after free on opcache OOM condition
diff --git a/ext/opcache/zend_accelerator_util_funcs.c b/ext/opcache/zend_accelerator_util_funcs.c
@@ -46,8 +46,10 @@ zend_persistent_script* create_persistent_script(void)
 void free_persistent_script(zend_persistent_script *persistent_script, int destroy_elements)
 {
 	if (!destroy_elements) {
-		persistent_script->script.function_table.pDestructor = NULL;
-		persistent_script->script.class_table.pDestructor = NULL;
+		/* Both the keys and values have been transferred into the global tables.
+		 * Set nNumUsed=0 to only deallocate the table, but not destroy any elements. */
+		persistent_script->script.function_table.nNumUsed = 0;
+		persistent_script->script.class_table.nNumUsed = 0;
 	} else {
 		destroy_op_array(&persistent_script->script.main_op_array);
 	}

Original file line number	Diff line number	Diff line change
`@@ -46,8 +46,10 @@ zend_persistent_script* create_persistent_script(void)`
`46`	`46`	`void free_persistent_script(zend_persistent_script *persistent_script, int destroy_elements)`
`47`	`47`	`{`
`48`	`48`	`if (!destroy_elements) {`
`49`		`- persistent_script->script.function_table.pDestructor = NULL;`
`50`		`- persistent_script->script.class_table.pDestructor = NULL;`
	`49`	`+ /* Both the keys and values have been transferred into the global tables.`
	`50`	`+ * Set nNumUsed=0 to only deallocate the table, but not destroy any elements. */`
	`51`	`+ persistent_script->script.function_table.nNumUsed = 0;`
	`52`	`+ persistent_script->script.class_table.nNumUsed = 0;`
`51`	`53`	`} else {`
`52`	`54`	`destroy_op_array(&persistent_script->script.main_op_array);`
`53`	`55`	`}`