Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[VarDumper] Fix FFI caster test #57397

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 22, 2024
Merged

Conversation

alexandre-daubois
Copy link
Member

Q A
Branch? 6.4
Bug fix? yes
New feature? no
Deprecations? no
Issues Fix #57387
License MIT

Fixes the invalid memory writing thanks to Arnaud's hints. Not easy to understand exactly what's the point of testCastNonTrailingCharPointer, so I hope the test is still valid like this.

@alexandre-daubois
Copy link
Member Author

cc @xabbuh this fixes CI on 8.4. I don't know if you've seen it, but just in case so you don't pull your hair out trying to figure out failure 😄

@xabbuh
Copy link
Member

xabbuh commented Jun 18, 2024

@alexandre-daubois 👍 thanks, I have seen it but I have no idea around this code. That's why I let @nicolas-grekas do the review here. :)

@nicolas-grekas
Copy link
Member

I don't have the knowledge to review this PR.
Maybe @arnaud-lb can help?

$pointer = \FFI::addr($string[0]);

\FFI::memcpy($pointer, $actualMessage, $actualLength);

// Remove automatically addition of the trailing "\0" and remove trailing "\0"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment can be removed as it's incorrect

Comment on lines 118 to 131
$ffi = \FFI::cdef(<<<C
bool is_zend_mm(void);
bool is_zend_ptr(const void *ptr);
C);

for ($i = 0; $i < self::MAX_STRING_LENGTH; ++$i) {
$result[$i] = $data[$i];
if ($ffi->is_zend_ptr($data) && $ffi->is_zend_mm()) {
$result[$i] = $data[$i];

if ("\0" === $result[$i]) {
return implode('', $result);
if ("\0" === $data[$i]) {
return implode('', $result);
}
} else {
break;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While testing I found that is_zend_ptr() is broken and may crash in some conditions. So my suggestion of using is_zend_ptr() is not good, sorry.

A safe alternative is to ensure that you only access memory in the same page as $data[0]: (it's safe as long as accessing $data[0] is safe)

        $ffi = \FFI::cdef(<<<C
            size_t zend_get_page_size(void);
        C);

        $pagesize = $ffi->zend_get_page_size();

        /* Get the address of $data */
        $start = $ffi->cast("uintptr_t", $ffi->cast("char*", $data))->cdata;
        /* Accessing memory in the same page as $start is safe */
        $max = min(self::MAX_STRING_LENGTH, ($start | ($pagesize - 1)) - $start);

        for ($i = 0; $i < $max; ++$i) {
            $result[$i] = $data[$i];

            if ("\0" === $data[$i]) {
                return implode('', $result);
            }
        }

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find a proper way to get the page size. This looks good, thanks Arnaud!

public function testCastNonTrailingCharPointer()
{
$actualMessage = 'Hello World!';
$actualLength = \strlen($actualMessage);

$string = \FFI::cdef()->new('char['.$actualLength.']');
$string = \FFI::cdef()->new('char['.($actualLength + 1).']');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Copy link
Contributor

@arnaud-lb arnaud-lb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

@fabpot
Copy link
Member

fabpot commented Jun 22, 2024

Thank you @alexandre-daubois.

@fabpot fabpot merged commit a26387b into symfony:6.4 Jun 22, 2024
2 of 10 checks passed
@alexandre-daubois alexandre-daubois deleted the ffi-caster-fix branch June 22, 2024 16:22
This was referenced Jun 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants
Morty Proxy This is a proxified and sanitized view of the page, visit original site.