Skip to content

Zend: Skip frameless registration for temporary modules - #24008

Closed
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-flf-dl-stale-handler
Closed

iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-flf-dl-stale-handler

Conversation

@iliaal

@iliaal iliaal commented Sep 30, 2026

Copy link
Copy Markdown
Member

dl() registers a module as MODULE_TEMPORARY, but zend_register_functions still stored its frameless handlers in the process-global tables. Request shutdown frees those function records, and a later request that maps the extension at the same address dispatches through the freed record. Temporary modules now leave the frameless info unset, so the call uses the ordinary internal path. Persistent modules still receive frameless info. The test skips when setarch -R cannot set the personality, which is what failed the 32-bit CI job.

@devnexen

Copy link
Copy Markdown
Member

can this test be added ?

--TEST--
dl() does not compile calls to a temporary module's function as frameless
--SKIPIF--
<?php include __DIR__ . "/skip.inc"; ?>
--EXTENSIONS--
opcache
--INI--
enable_dl=1
opcache.enable_cli=1
opcache.opt_debug_level=0x10000
--FILE--
<?php
dl(PHP_OS_FAMILY === 'Windows' ? 'php_dl_test.dll' : 'dl_test.so');
include __DIR__ . '/frameless_temporary.inc';
?>
--EXPECTF--
%A0001 INIT_FCALL 1 %d string("dl_test_frameless")
%Aint(7)
dl_test_frameless(): Argument #1 ($value) must be of type int, string given

@devnexen

Copy link
Copy Markdown
Member

fix itself is correct IMO otherwise.

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is fine. But again this shows what kind of a PITA dl() is.

dl() modules are MODULE_TEMPORARY. Their function records are freed at
request shutdown, but zend_flf_functions keeps those pointers for the
process lifetime. A later request can match the stale handler address
and use the freed record. Temporary modules leave the frameless info
unset, so the call uses the ordinary internal path.
@iliaal
iliaal force-pushed the fix/aph-flf-dl-stale-handler branch from 5bee9c8 to 49fd095 Compare September 30, 2026 13:23
@iliaal

iliaal commented Sep 30, 2026

Copy link
Copy Markdown
Member Author

Added as frameless_temporary_opcache.phpt.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants