From: Xinchen Hui <laruence@gmail.com>
Date: Sat, 27 May 2017 14:42:17 +0000 (+0800)
Subject: Fixed bug #74663 (Segfault with opcache.memory_protect and validate_timestamp)
X-Git-Tag: php-7.0.21RC1~40
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=60912e66c8c6089cced22b14eadfade11e89d70a;p=php

Fixed bug #74663 (Segfault with opcache.memory_protect and validate_timestamp)
---

diff --git a/NEWS b/NEWS
index 484e684352..419d8aad3b 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug #74658 (Undefined constants in array properties result in broken
     properties). (Laruence)
 
+- Opcache:
+  . Fixed bug #74663 (Segfault with opcache.memory_protect and
+    validate_timestamp). (Laruence)
+
 - SPL:
   . Fixed bug #74478 (null coalescing operator failing with SplFixedArray).
     (jhdxr)
diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index 0b7c64bc9e..4c57e5c91e 100644
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -957,6 +957,17 @@ int validate_timestamp_and_record(zend_persistent_script *persistent_script, zen
 	}
 }
 
+int validate_timestamp_and_record_ex(zend_persistent_script *persistent_script, zend_file_handle *file_handle)
+{
+	int ret;
+
+	SHM_UNPROTECT();
+	ret = validate_timestamp_and_record(persistent_script, file_handle);
+	SHM_PROTECT();
+
+	return ret;
+}
+
 /* Instead of resolving full real path name each time we need to identify file,
  * we create a key that consist from requested file name, current working
  * directory, current include_path, etc */
diff --git a/ext/opcache/ZendAccelerator.h b/ext/opcache/ZendAccelerator.h
index 738a82954f..8f2349a010 100644
--- a/ext/opcache/ZendAccelerator.h
+++ b/ext/opcache/ZendAccelerator.h
@@ -331,6 +331,7 @@ void zend_accel_schedule_restart(zend_accel_restart_reason reason);
 void zend_accel_schedule_restart_if_necessary(zend_accel_restart_reason reason);
 accel_time_t zend_get_file_handle_timestamp(zend_file_handle *file_handle, size_t *size);
 int  validate_timestamp_and_record(zend_persistent_script *persistent_script, zend_file_handle *file_handle);
+int  validate_timestamp_and_record_ex(zend_persistent_script *persistent_script, zend_file_handle *file_handle);
 int  zend_accel_invalidate(const char *filename, int filename_len, zend_bool force);
 int  zend_accel_script_optimize(zend_persistent_script *persistent_script);
 int  accelerator_shm_read_lock(void);
diff --git a/ext/opcache/tests/bug74663.phpt b/ext/opcache/tests/bug74663.phpt
new file mode 100644
index 0000000000..32248b80a1
--- /dev/null
+++ b/ext/opcache/tests/bug74663.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #74663 (Segfault with opcache.memory_protect and validate_timestamp)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.enable_file_override=1
+opcache.validate_timestamps=1
+opcache.revalidate_freq=0
+opcache.protect_memory=1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$file = __DIR__ . "/bug74663.inc";
+file_put_contents($file, "");
+include $file;
+
+var_dump(is_file($file));
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . "/bug74663.inc");
+--EXPECT--
+bool(true)
diff --git a/ext/opcache/zend_accelerator_module.c b/ext/opcache/zend_accelerator_module.c
index 898a13c6db..6112027cd8 100644
--- a/ext/opcache/zend_accelerator_module.c
+++ b/ext/opcache/zend_accelerator_module.c
@@ -341,7 +341,7 @@ static int filename_is_in_cache(zend_string *filename)
 			handle.type = ZEND_HANDLE_FILENAME;
 
 			if (ZCG(accel_directives).validate_timestamps) {
-				return validate_timestamp_and_record(persistent_script, &handle) == SUCCESS;
+				return validate_timestamp_and_record_ex(persistent_script, &handle) == SUCCESS;
 			}
 
 			return 1;