Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix leak+crash with sapi_windows_set_ctrl_handler() #18231

Open
wants to merge 1 commit into
base: PHP-8.3
Choose a base branch
from
Open

Fix leak+crash with sapi_windows_set_ctrl_handler() #18231

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions sapi/cli/tests/sapi_windows_set_ctrl_handler_leak.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
--TEST--
sapi_windows_set_ctrl_handler() leak bug
--SKIPIF--
<?php
include "skipif.inc";

if (strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN')
die("skip this test is for Windows platforms only");
?>
--FILE--
<?php

class Test {
public function set() {
sapi_windows_set_ctrl_handler(self::cb(...));
}
public function cb() {
}
}

$test = new Test;
$test->set();

echo "Done\n";

?>
--EXPECT--
Done
2 changes: 2 additions & 0 deletions win32/globals.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,5 +63,7 @@ PHP_RSHUTDOWN_FUNCTION(win32_core_globals)
{/*{{{*/
closelog();

php_win32_signal_ctrl_handler_request_shutdown();

return SUCCESS;
}/*}}}*/
23 changes: 21 additions & 2 deletions win32/signal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,9 +68,28 @@ PHP_WINUTIL_API void php_win32_signal_ctrl_handler_shutdown(void)
zend_interrupt_function = orig_interrupt_function;
orig_interrupt_function = NULL;
vm_interrupt_flag = NULL;
ZVAL_UNDEF(&ctrl_handler);
}/*}}}*/

PHP_WINUTIL_API void php_win32_signal_ctrl_handler_request_shutdown(void)
{
/* Must be initialized and in main thread */
if (!vm_interrupt_flag) {
return;
}
#ifdef ZTS
if (!tsrm_is_main_thread()) {
return;
}
#endif

/* The ctrl_handler must be cleared between requests, otherwise we can crash
* due to accessing a previous request's memory. */
if (!Z_ISUNDEF(ctrl_handler)) {
zval_ptr_dtor(&ctrl_handler);
ZVAL_UNDEF(&ctrl_handler);
}
}

static BOOL WINAPI php_win32_signal_system_ctrl_handler(DWORD evt)
{/*{{{*/
if (CTRL_C_EVENT != evt && CTRL_BREAK_EVENT != evt) {
Expand Down Expand Up @@ -125,7 +144,7 @@ PHP_FUNCTION(sapi_windows_set_ctrl_handler)
RETURN_FALSE;
}

zval_ptr_dtor_nogc(&ctrl_handler);
zval_ptr_dtor(&ctrl_handler);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is also a fix, this is needed because the handler closure object can be cyclic.

ZVAL_COPY(&ctrl_handler, &fci.function_name);

RETURN_TRUE;
Expand Down
1 change: 1 addition & 0 deletions win32/signal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
#define SIGPROF 27 /* profiling time alarm */

PHP_WINUTIL_API void php_win32_signal_ctrl_handler_init(void);
PHP_WINUTIL_API void php_win32_signal_ctrl_handler_request_shutdown(void);
PHP_WINUTIL_API void php_win32_signal_ctrl_handler_shutdown(void);

#endif /* PHP_WIN32_SIGNAL_H */
Loading