Fix bug #79643: Invalid memory read when opcache.interned_strings_buffer is 0

diff --git a/NEWS b/NEWS
index e5e20b0e5c31e3aab9ed00066c569d83df750f82..2165f0c9209b3a6fcd57d206d8069011e57a6126 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug #64076 (imap_sort() does not return FALSE on failure). (cmb)
   . Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb)
 
+- Opcache:
+  . Fixed bug #79643 (PHP with Opcache crashes when a file with specific name
+    is included). (twosee)
+
 - OpenSSL:
   . Fixed bug #79983 (openssl_encrypt / openssl_decrypt fail with OCB mode).
     (Nikita)

diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index 3da1a5492ec9b0f0326d651592f6280519722067..21dba385da2c8f114897a8ed67770357c403a9a8 100644 (file)
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -2576,7 +2576,9 @@ static int zend_accel_init_shm(void)
        if (ZCG(accel_directives).interned_strings_buffer) {
                accel_shared_globals = zend_shared_alloc((ZCG(accel_directives).interned_strings_buffer * 1024 * 1024));
        } else {
-               accel_shared_globals = zend_shared_alloc(sizeof(zend_accel_shared_globals));
+               /* Make sure there is always at least one interned string hash slot,
+                * so the table can be queried unconditionally. */
+               accel_shared_globals = zend_shared_alloc(sizeof(zend_accel_shared_globals) + sizeof(uint32_t));
        }
        if (!accel_shared_globals) {
                zend_accel_error(ACCEL_LOG_FATAL, "Insufficient shared memory!");
@@ -2617,6 +2619,8 @@ static int zend_accel_init_shm(void)
                        STRTAB_INVALID_POS,
                        (char*)ZCSG(interned_strings).start -
                                ((char*)&ZCSG(interned_strings) + sizeof(zend_string_table)));
+       } else {
+               *STRTAB_HASH_TO_SLOT(&ZCSG(interned_strings), 0) = STRTAB_INVALID_POS;
        }
 
        zend_interned_strings_set_request_storage_handlers(accel_new_interned_string_for_php, accel_init_interned_string_for_php);