Segment Fault passing a vector as argument about ext-php-rs

[ju1ius]

IMO the ::types::array::Iter implementation should not fiddle with the hashtable internal buckets directly.
That's likely to break often and introduce safety/soundness issues.

Instead, the implementation should be refactored to use the iteration functions in Zend/zend_hash.c (i.e zend_hash_iterator_add, zend_hash_iterator_pos, zend_hash_get_current_pos, etc...).

[ju1ius]

Sounds good! Do you want to take this with a PR?

If I remember correctly, I already have a POC somewhere locally.
Just have to find the time to come back at it... 😓

In the meantime, if anyone wants to have a stab at it, one just need to look at how it's done in the C implementation for SPL's ArrayIterator.

[ewguo]

I'm also having this issue with PHP 8.2 (fpm) but not 8.1.

[pedrosoares]

Can confirm, PHP 8.1.14 works fine.

[ptondereau]

Hello and thanks for the report. I think this related to packed array optimization that landed in PHP 8.2.0 and I've implemented very (too?) quickly in #212

[ptondereau]

IMO the ::types::array::Iter implementation should not fiddle with the hashtable internal buckets directly.

That's likely to break often and introduce safety/soundness issues.

Instead, the implementation should be refactored to use the iteration functions in Zend/zend_hash.c (i.e zend_hash_iterator_add, zend_hash_iterator_pos, zend_hash_get_current_pos, etc...).

Sounds good! Do you want to take this with a PR?

[joehoyle]

I'm running into this too, though under PHP 8.0, not 8.2. Specifically the issue I'm seeing is given the PHP array [ 1 ], I get a segfault in some cases.

Specifically the bug is laying in https://github.com/davidcole1340/ext-php-rs/blob/master/src/types/array.rs#L538. In some cases (I don't know why), though the Array has 1 item (nNumOfElements == 1), nNumUsed is set to two. The end is then miscalculated to be an offset beyond (I guess) the end of the array. That in turn means the bucket.key reference is set to 0xffffffffffffffff, which cases a segfault when calling trying to call ext_php_rs_is_known_valid_utf8 on that invalid pointer reference.

[AdrienGras]

Hi,

Any update on this ? I'm also having issues with PHP 8.2.4, but everything is fine with PHP 8.1

[ptondereau]

Hi,

Any update on this ? I'm also having issues with PHP 8.2.4, but everything is fine with PHP 8.1

I don't have any room to work on it for the moment but I'm available to do reviews if someone is up.