Don't keep HashTable.pDestructor in SHM and always set it into ZVAL_PTR_DTOR in zval_...

Keeping pointer to a function in SHM is not safe because of ASLR.

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 3b905fd30c021801bb2ab3a301a74c2903572eb7..dc44383855340974afb9065b04ff419b69a41fd7 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1765,7 +1765,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
        GC_TYPE_INFO(target) = IS_ARRAY;
 
        target->nTableSize = source->nTableSize;
-       target->pDestructor = source->pDestructor;
+       target->pDestructor = ZVAL_PTR_DTOR;
 
        if (source->nNumUsed == 0) {
                target->u.flags = (source->u.flags & ~(HASH_FLAG_INITIALIZED|HASH_FLAG_PACKED|HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;

diff --git a/ext/opcache/zend_persist.c b/ext/opcache/zend_persist.c
index b63b116510ef5e6061c9f915fa8572d66ce17e00..3e55331313c9a0fed52f376d5f5eb317e33abc58 100644 (file)
--- a/ext/opcache/zend_persist.c
+++ b/ext/opcache/zend_persist.c
@@ -86,6 +86,8 @@ static void zend_hash_persist(HashTable *ht, zend_persist_func_t pPersistElement
        uint32_t idx, nIndex;
        Bucket *p;
 
+       ht->pDestructor = NULL;
+
        if (!(ht->u.flags & HASH_FLAG_INITIALIZED)) {
                HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
                return;
@@ -170,6 +172,8 @@ static void zend_hash_persist_immutable(HashTable *ht)
        uint32_t idx, nIndex;
        Bucket *p;
 
+       ht->pDestructor = NULL;
+
        if (!(ht->u.flags & HASH_FLAG_INITIALIZED)) {
                HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
                return;