opcache.file_cache: segfault or wrong function for functions loaded with dl()

Aberta
  • Algo errado?
#25,296 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
48/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
c, php
Domínio
backend, performance

Direção de pesquisa

Start with the ZEND_INIT_FCALL offset handling in zend_file_cache.c and review the change identified as d6541df63, along with related issue GH-24661. Reproduce the supplied dl() and OPcache file cache commands using the example scripts, then trace how functions added by the extension affect cached calls. Done means repeated runs call dl_test_test2() and print "Hello World" without a crash or calling a different function.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Description

Quoted text written with an LLM and checked by a human developer.

A script in the file cache can crash or call the wrong function if it calls a function loaded with dl(), and that function has a different position in the function table on a later run.

d6541df63 (GH-24664) removed the reset of the ZEND_INIT_FCALL offset from zend_file_cache.c. The old comment said the reset could go once system ID validation was in place. The system ID is finalized at startup, so it does not cover functions added later by dl().

main.php:

<?php
if (isset($argv[1])) {
    function a() {}
    function b() {}
}
dl('dl_test');
include __DIR__ . '/call.php';

call.php:

<?php
var_dump(dl_test_test2());

With dl_test built as a shared extension:

PHP="php -d opcache.enable_cli=1 -d opcache.file_cache=/tmp/fc -d opcache.file_cache_only=1 -d opcache.file_update_protection=0"
$PHP main.php x
$PHP main.php

Resulted in this output:

string(11) "Hello World"
Segmentation fault

But I expected this output instead:

string(11) "Hello World"
string(11) "Hello World"

With only function a() {}, the second run calls a different function:

Fatal error: Uncaught ArgumentCountError: dl_test_frameless() expects exactly 1 argument, 0 given

Tested on debug and release builds of PHP-8.4 at 3ace94211. An earlier build at 2f6fd1167, without d6541df63, prints the expected output. The reset is also gone from the sources of php-8.4.28RC1, php-8.5.13RC1 and php-8.6.0RC5, which I did not build.

Related: GH-24661

PHP Version
PHP 8.4.28-dev (3ace94211)
Operating System

Ubuntu 26.04

Linguagem predominante
C
Estrelas
41.8k
Forks
8.5k
Merge médio
2d 12h
PRs com merge (30d)
137

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de php/php-src

Todas as issues de php/php-src

Issues semelhantes

Mais issues de C

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.