Skip to content

Commit 21b146c

Browse files
minor #47673 [VarDumper] Fix use-after-free with nested FFI::addr() in test (iluuu1994)
This PR was merged into the 6.2 branch. Discussion ---------- [VarDumper] Fix use-after-free with nested FFI::addr() in test | Q | A | ------------- | --- | Branch? | 6.2 | Bug fix? | no | New feature? | no | Deprecations? | no | Tickets | php/php-src#9598 | License | MIT | Doc PR | This issue was found by the PHP community build, after which I created php/php-src#9598. Basically, the inner `\FFI::addr()` `CData` will be deallocated after the second `\FFI::addr()` call which will be stored and then points to invalid memory. However, [it turns out](php/php-src#9599 (comment)) nesting `\FFI::addr()` calls without temporarily storing the result is actually not allowed. https://www.php.net/manual/en/ffi.addr.php > Creates an unmanaged pointer to the C data represented by the given `FFI\CData`. The source ptr must survive the resulting pointer. This function is mainly useful to pass arguments to C functions by pointer. We'll see if we can improve `FFI` by throwing an exception when passing temporary values to `FFI::addr()`. Either way, this test is not valid. Commits ------- 4c799152ec Fix use-after-free with nested FFI::addr() in VarDumper test
2 parents 67a4ebb + 8036bfb commit 21b146c

File tree

1 file changed

+0
-6
lines changed

1 file changed

+0
-6
lines changed

Tests/Caster/FFICasterTest.php

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -392,12 +392,6 @@ public function testCastPointerToStruct()
392392
}
393393
OUTPUT, \FFI::addr($struct));
394394

395-
$this->assertDumpEquals(<<<'OUTPUT'
396-
FFI\CData<struct <anonymous>**> size 8 align 8 {
397-
cdata: null
398-
}
399-
OUTPUT, \FFI::addr(\FFI::addr($struct)));
400-
401395
// Save the pointer as variable so that
402396
// it is not cleaned up by the GC
403397
$pointer = \FFI::addr($struct);

0 commit comments

Comments
 (0)