Skip to content

Commit b6938a2

Browse files
jorgsowaGirgias
authored andcommitted
phpdbg: fix leaked lowercased lookup keys in phpdbg_resolve_opline_break
phpdbg_resolve_opline_break() passed the result of zend_str_tolower_dup() directly as the lookup key to zend_hash_str_find_ptr() for both the class and the function/method lookups. That emalloc'd buffer was never freed, leaking on every method/function opline breakpoint resolution. Use zend_hash_str_find_ptr_lc(), which lowercases into a (stack-allocated for short names) temporary and frees it internally, instead of duplicating the key by hand and leaking it. Add a regression test that exercises all three paths through the two lookups (class + method found, method not found, class not found). Closes phpGH-22563
1 parent eb9eaa2 commit b6938a2

3 files changed

Lines changed: 30 additions & 2 deletions

File tree

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ PHP NEWS
3838

3939
- PHPDBG:
4040
. Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
41+
. Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
42+
(jorgsowa)
4143

4244
- Reflection:
4345
. Fixed bug GH-22324 (Ignore leading namespace separator in

sapi/phpdbg/phpdbg_bp.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -604,13 +604,13 @@ PHPDBG_API int phpdbg_resolve_opline_break(phpdbg_breakopline_t *new_break) /* {
604604

605605
if (new_break->class_name != NULL) {
606606
zend_class_entry *ce;
607-
if (!(ce = zend_hash_str_find_ptr(EG(class_table), zend_str_tolower_dup(new_break->class_name, new_break->class_len), new_break->class_len))) {
607+
if (!(ce = zend_hash_str_find_ptr_lc(EG(class_table), new_break->class_name, new_break->class_len))) {
608608
return FAILURE;
609609
}
610610
func_table = &ce->function_table;
611611
}
612612

613-
if (!(func = zend_hash_str_find_ptr(func_table, zend_str_tolower_dup(new_break->func_name, new_break->func_len), new_break->func_len))) {
613+
if (!(func = zend_hash_str_find_ptr_lc(func_table, new_break->func_name, new_break->func_len))) {
614614
if (new_break->class_name != NULL && new_break->func_name != NULL) {
615615
phpdbg_error("Method %s doesn't exist in class %s", new_break->func_name, new_break->class_name);
616616
return 2;
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
Resolving method/function opline breakpoints must not leak the lookup keys
3+
--PHPDBG--
4+
b Foo::bar#0
5+
b baz#0
6+
b Foo::nope#0
7+
b Nope::bar#0
8+
q
9+
--EXPECTF--
10+
[Successful compilation of %s]
11+
prompt> [Breakpoint #0 added at Foo::bar#0]
12+
prompt> [Breakpoint #1 added at baz#0]
13+
prompt> [Method nope doesn't exist in class Foo]
14+
prompt> [Pending breakpoint #3 at Nope::bar#0]
15+
prompt>
16+
--FILE--
17+
<?php
18+
class Foo {
19+
public function bar($x) {
20+
return $x + 1;
21+
}
22+
}
23+
24+
function baz($y) {
25+
return $y * 2;
26+
}

0 commit comments

Comments
 (0)