From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 24 Jan 2020 15:18:28 +0000 (+0100)
Subject: Fixed bug #79128
X-Git-Tag: php-7.4.7RC1~276
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3291891408556cb412bf1093a6112951dec1421e;p=php

Fixed bug #79128

We need to extend the hash table before performing raw append
operations.

This doesn't matter if preloading happens in the same process,
as the tables will be large enough to hold all entries as a
side-effect of the preloading process. However, if preloading
happens in a different process, we need to reserve space here.
---

diff --git a/NEWS b/NEWS
index de126e54c3..cc68ef78b2 100644
--- a/NEWS
+++ b/NEWS
@@ -29,8 +29,9 @@ PHP                                                                        NEWS
     with more than 20 chars). (Nikita)
 
 - Opcache:
-  . Fixed #79114 (Eval class during preload causes class to be only half
+  . Fixed bug #79114 (Eval class during preload causes class to be only half
     available). (Laruence)
+  . Fixed bug #79128 (Preloading segfaults if preload_user is used). (Nikita)
 
 - OpenSSL:
   . Fixed bug #79145 (openssl memory leak). (cmb, Nikita)
diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index 263336d99e..c7d73a999a 100644
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -4200,19 +4200,24 @@ static zend_persistent_script* preload_script_in_shared_memory(zend_persistent_s
 static void preload_load(void)
 {
 	/* Load into process tables */
-	if (zend_hash_num_elements(&ZCSG(preload_script)->script.function_table)) {
-		Bucket *p = ZCSG(preload_script)->script.function_table.arData;
-		Bucket *end = p + ZCSG(preload_script)->script.function_table.nNumUsed;
+	zend_script *script = &ZCSG(preload_script)->script;
+	if (zend_hash_num_elements(&script->function_table)) {
+		Bucket *p = script->function_table.arData;
+		Bucket *end = p + script->function_table.nNumUsed;
 
+		zend_hash_extend(CG(function_table),
+			CG(function_table)->nNumUsed + script->function_table.nNumUsed, 0);
 		for (; p != end; p++) {
 			_zend_hash_append_ptr_ex(CG(function_table), p->key, Z_PTR(p->val), 1);
 		}
 	}
 
-	if (zend_hash_num_elements(&ZCSG(preload_script)->script.class_table)) {
-		Bucket *p = ZCSG(preload_script)->script.class_table.arData;
-		Bucket *end = p + ZCSG(preload_script)->script.class_table.nNumUsed;
+	if (zend_hash_num_elements(&script->class_table)) {
+		Bucket *p = script->class_table.arData;
+		Bucket *end = p + script->class_table.nNumUsed;
 
+		zend_hash_extend(CG(class_table),
+			CG(class_table)->nNumUsed + script->class_table.nNumUsed, 0);
 		for (; p != end; p++) {
 			_zend_hash_append_ex(CG(class_table), p->key, &p->val, 1);
 		}