From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 5 Mar 2018 21:56:16 +0000 (+0300)
Subject: Don't keep HashTable.pDestructor in SHM and always set it into ZVAL_PTR_DTOR in zval_... 
X-Git-Tag: php-7.2.4RC1~27^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b711a96acb36cd1bf6191552d9876194f9dc15a4;p=php

Don't keep HashTable.pDestructor in SHM and always set it into ZVAL_PTR_DTOR in zval_array_dup().
Keeping pointer to a function in SHM is not safe because of ASLR.
---

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 3b905fd30c..dc44383855 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1765,7 +1765,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 	GC_TYPE_INFO(target) = IS_ARRAY;
 
 	target->nTableSize = source->nTableSize;
-	target->pDestructor = source->pDestructor;
+	target->pDestructor = ZVAL_PTR_DTOR;
 
 	if (source->nNumUsed == 0) {
 		target->u.flags = (source->u.flags & ~(HASH_FLAG_INITIALIZED|HASH_FLAG_PACKED|HASH_FLAG_PERSISTENT|ZEND_HASH_APPLY_COUNT_MASK)) | HASH_FLAG_APPLY_PROTECTION | HASH_FLAG_STATIC_KEYS;
diff --git a/ext/opcache/zend_persist.c b/ext/opcache/zend_persist.c
index b63b116510..3e55331313 100644
--- a/ext/opcache/zend_persist.c
+++ b/ext/opcache/zend_persist.c
@@ -86,6 +86,8 @@ static void zend_hash_persist(HashTable *ht, zend_persist_func_t pPersistElement
 	uint32_t idx, nIndex;
 	Bucket *p;
 
+	ht->pDestructor = NULL;
+
 	if (!(ht->u.flags & HASH_FLAG_INITIALIZED)) {
 		HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
 		return;
@@ -170,6 +172,8 @@ static void zend_hash_persist_immutable(HashTable *ht)
 	uint32_t idx, nIndex;
 	Bucket *p;
 
+	ht->pDestructor = NULL;
+
 	if (!(ht->u.flags & HASH_FLAG_INITIALIZED)) {
 		HT_SET_DATA_ADDR(ht, &uninitialized_bucket);
 		return;