From 1c9bfcb6a766d4062f2dd1e594b30831d59cc36c Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 22 Oct 2019 11:33:00 +0200 Subject: [PATCH] Fix #78716: Function name mangling is wrong for some parameter types We have to cater to function parameter alignment when calculating the parameter size. --- NEWS | 4 ++++ ext/ffi/ffi.c | 2 +- ext/ffi/tests/callconv.phpt | 30 +++++++++++++++--------------- ext/ffi/tests/callconv_x86.dll | Bin 8704 -> 8704 bytes 4 files changed, 20 insertions(+), 16 deletions(-) diff --git a/NEWS b/NEWS index a192b92ea4..5003143e92 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,10 @@ PHP NEWS - Date: . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin) +- FFI: + . Fixed bug #78716 (Function name mangling is wrong for some parameter + types). (cmb) + - FPM: . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043) (Jakub Zelenka) diff --git a/ext/ffi/ffi.c b/ext/ffi/ffi.c index 1d6f84b6b2..1edba157a1 100644 --- a/ext/ffi/ffi.c +++ b/ext/ffi/ffi.c @@ -775,7 +775,7 @@ static size_t zend_ffi_arg_size(zend_ffi_type *type) /* {{{ */ size_t arg_size = 0; ZEND_HASH_FOREACH_PTR(type->func.args, arg_type) { - arg_size += ZEND_FFI_TYPE(arg_type)->size; + arg_size += MAX(ZEND_FFI_TYPE(arg_type)->size, sizeof(size_t)); } ZEND_HASH_FOREACH_END(); return arg_size; } diff --git a/ext/ffi/tests/callconv.phpt b/ext/ffi/tests/callconv.phpt index aa481de224..233c73f110 100644 --- a/ext/ffi/tests/callconv.phpt +++ b/ext/ffi/tests/callconv.phpt @@ -9,32 +9,32 @@ if (PHP_INT_SIZE != 4) die("skip this test is for 32bit platforms only"); --FILE-- cdecl_func(1, 2.3); -$ffi1->stdcall_func(4, 5.6); -$ffi1->fastcall_func(7, 8.9); +$ffi1->cdecl_func(1, 2.3, 'a'); +$ffi1->stdcall_func(4, 5.6, 'b'); +$ffi1->fastcall_func(7, 8.9, 'c'); file_put_contents($headername, "#define FFI_LIB \"$dllname\"\n$header"); $ffi2 = FFI::load($headername); -$ffi2->cdecl_func(2, 3.4); -$ffi2->stdcall_func(5, 6.7); -$ffi2->fastcall_func(8, 9.1); +$ffi2->cdecl_func(2, 3.4, 'a'); +$ffi2->stdcall_func(5, 6.7, 'b'); +$ffi2->fastcall_func(8, 9.1, 'c'); ?> --EXPECT-- -cdecl: 1, 2.300000 -stdcall: 4, 5.600000 -fastcall: 7, 8.900000 -cdecl: 2, 3.400000 -stdcall: 5, 6.700000 -fastcall: 8, 9.100000 +cdecl: 1, 2.300000, a +stdcall: 4, 5.600000, b +fastcall: 7, 8.900000, c +cdecl: 2, 3.400000, a +stdcall: 5, 6.700000, b +fastcall: 8, 9.100000, c --CLEAN-- TU18Bg260JG*%_rT2SeG7*DXXZMkT8G&+QqHpEc6WbJZGd?iW0?~ zhT0TA;4DMGQEcVtq{8r;^2wln*loP6H@J0mp&89>{bHp#E@^zfDx@2sO zT~3eZx@W$bA7%VQDgH$RNjZSeVr%rn7rzd_*>{zZHz&!;#)}$4N0cV+`}Br#rDjS+ z$h1m+k1kfN__m%S#M5|DNBjm~pBYZuvIy}L*^mi59F^4e=*=!rz7Qh5p%kc)gB%o<=;L&Ex@YMY%H6bNg(cC_*H z58e0YQL4NNK=_(I@;#=Q)r5543auppQ-i!VSxtc6S1k{A*WPOBS_CffG`;ZrSnS7* zpU0(t$vun{^Q+}6SX}n&d{MTYXHaKQz=9H#wkRSVO)6UW9b|sfHwU>!mO3<}>#X#$vkC;2gWOoGpbgE0WceFn6@5-q*&8D@dw=r)<&b@AfOv9|0|&}jUx zqjnXub-8D|+;d&-`=?HwI?w!*09=4Q3b1KJ#fsquxfjM_ew93lcY4{c@sVQW+DcdI zs<|H8s;lLu=#Z{Vo0(`9jXa-0r*(zgHL6}@<_^%u7j<#B=-EZS%-7L0@4Zgza#m(- zX&CNhS}(NkD17(m%Q-ui$0cK2GQ=evyH&0l@Tsvf<#+I9hb|QiY4md(olwjKkFO?V zzJ!oRFn5Jc2Gzq>|B#K{7^SP>?Ss+xkda;S3r8RI=C0!i?ayuE?$O1@d@h5Q8rLn$ z1BnU3BoaOSWc^0AOCvpOyi&Xque|KV7H_}{GqT`hQ@XjmBLyqz!KL|?$IWSLpxL~k zx*9}+b540MZ2NYGom`03CwaYeVrgzIE^E>WMp+`Txr4FO|4U`9$z%h?$yZgjhv{Y; z$}$T*2~r$?V9aN+pq1{ z?elg!FY-_G&+z;C0Dpk*!VO_YxGl^J(wb$Ca);m1=NNH(?2sL^4yALc^D$?Y z^Eu}Z=PqZ!dB}Og`5$L~`JM8mE|bgYs&+l)^0@Z7UUWrV{jOnGc7>tBTw$xIt=LvE zQ*o!_K}ES(E7pr)@m2AJI3S)8hs9CxBk^zIr{bh|LoAySZ;Nx{yr`_yR^l9SH29G= d%YfyyrPtbLJ#9V5U*%`{Io>D~2)Lrg{|hro3Sa;L delta 2671 zcmcgte{5679lvwz_$9I92XTIMVUQmVp%g{7^Iq&YFHKTN3lkAxq?AAnb7NA+N!zr% z2SI~6nVmIhR0f>bhSVXTr~-zjjL0NVB(sB6E<4=St+dp_`kMWbKdAu5`pV|ffY}drJ ztc};E_i5v&)BCkCKD`^p#lDGY1;#zbiKz}48#-@jenaOcTD+li)fCe;bY9i`A9l0_ z*dFNNcF3ObXmcY%>#+fiUaa=cN54S2;w+q!kR%oFl>W~?hJ&2h-Re&ABkEbSK*9QN4$pekP9Y8qH+^`g9ENf4_!NS zfnL}!u#fFpngz33`=iRE^mB-SxG2!WqB4uBnJoITVM`_Ab+D}S=74wljh7#e&k-Tg(ElH*!TUEtGjOpJC%~)RdPOHja=xZzztBejcCH#YCn2cI? zY~MB(3mWNr5E>7f0‚jqI9$d35_=&Qc9Z!wF`r6DxXI2qnKhr+d5Hp&)yo}K3< zh|oVm2H`TsqxtM|Vf`RdmDLe|e=YJ$ro=Pae5;{R{ zr?1B!kP2g7{TpAa>QG`(nGCB~De0e8mTqc>3qlp(H*IEC4!cC6t(GIeJ_c+gs%VO3N!v*Cz?iuQVrl}58leLRZXrE=IIBE# zmQ|tE8>4%`faOgAKO{tdtrdq})JRL@B#dmgw;6rsIP|bUct3{}<7LB-U;?IZvM2FV zh(HEGXoj{XhK3~4Nf z+Lk0!DP(iuidq8QEHhKml^=6PXYAoIb?LO z`Lj8YehTiz?@p1YvX`fyW9B(9ODzlE^6|h;ax(kbmF#e870rj&M^&tY>8irRo3S}? zorjl9&+hj7@Ir?_TC#m)iRGU-1l8FXuI**n?rZPc&t1@=sGI@DJ76d+mfv{ih8pL> ziMrE$a@`p{EUOqt4jWN2dPO{V*`q(xywQW&Fx1G6 z#h@arkt@2s(D4-rWdl|LrT}rkyMX)U2)zztH=qSj4`A)|a)izU1^}$R4Z2Lg0l+JO zWX!BFWIg0%>!)Si@N_C(@%v;SLOkpQPbuZw zcJ(A_WF;@;=GPv#%}3=n+q#AZ5F)s7sTqvhx|MOK7ji90-8u4MZcY>Y7*H=LDzt@d zJxo3S|Et)U-0VVGvRV}#%(pq2Mh{Pf6(Ge`GOmCW=jGr5BIbqh5^^zb89obrq2Xu_ z;z!AYyux*%0>mE%Fg0uNcTm~58+L$0Bls|A*aE&E&UuyoAk2Kg5#r5X9(1BM z|IW6q9qr1CZD>d85@=q%LrZdP>e{d^#=*81A+&D+Hw;(I58RdoTpYN1;0hLSUy*zH zg&qI5%RcgQK`8C~61_fTg`!}4p}or9VvpF*+i%$G9G#9H$5F>I$9s-Tjxk4;GspR) zv)Q@T+2xEluQ{pnWaa0T4=O7Jm+*wJPUsL`5)|RbLZ9%Oa6mXByeYgToE3g6j0#cV ziVzoW34ayt3JKvWK`&ZGn<$92;D2sjKFGAu~@rHO?oEGni55(>&t4nb0bp6ux zd)J>_ldik2glpC{=hC@3_xIgSceT6Dz0tkR9dpOse|Jw*->;sl&h;$ylzOT>Kk#hu zJm=~29P`Y2{^j9omey3)tf{$PbGznFO_@|J)l1#dUg;;&LFuS;R=Oa)FGZ!x(&BMx kLb@(}CQV9rrGzvqrPmU^*lM~WP)L`9bXSPvL*4kl0a@@itpET3 -- 2.50.0