-
-
Notifications
You must be signed in to change notification settings - Fork 9.7k
Description
Symfony version(s) affected
6.2
Description
symfony/src/Symfony/Component/VarDumper/Tests/Caster/FFICasterTest.php
Lines 194 to 205 in e6d6bed
/** | |
* It is worth noting that such a test can cause SIGSEGV, as it breaks | |
* into "foreign" memory. However, this is only theoretical, since | |
* memory is allocated within the PHP process and almost always "garbage | |
* data" will be read from the PHP process itself. | |
* | |
* If this test fails for some reason, please report it: We may have to | |
* disable the dumping of strings ("char*") feature in VarDumper. | |
* | |
* @see FFICaster::castFFIStringValue() | |
*/ | |
public function testCastNonTrailingCharPointer() |
See https://github.com/iluuu1994/php-src/actions/runs/3106907448/jobs/5034370701.
How to reproduce
Possible Solution
The NUL
byte should be part of the array, otherwise this is writing to unrelated memory. The memory sanitizer complains about $pointer[$actualLength] = "\x01";
, because the assignment happens to unowned memory. The string should be allocated as $string = \FFI::new('char['.($actualLength + 1).']');
to allow this, although that likely defeats the purpose of the test as there is probably another NUL
byte right after. Printing char*
is likely unsafe because user allocated C strings are not guaranteed to be NUL
-terminated. Just reading from the unowned memory is also unsafe and can cause SEGFAULTs.
Additional Context
No response