Skip to content

Commit 5a8f96b

Browse files
dstogovdstogov
committedOct 9, 2023
Fixed GH-12382: JIT Index invalid or out of range error
·
security-audit-2024php-8.1.25RC1
1 parent 6bb536e commit 5a8f96b

File tree

2 files changed

+76
-7
lines changed

2 files changed

+76
-7
lines changed
 

‎ext/opcache/jit/zend_jit_x86.dasc

+37-7
Original file line numberDiff line numberDiff line change
@@ -4377,6 +4377,7 @@ static int zend_jit_math_long_long(dasm_State **Dst,
43774377
uint32_t res_use_info,
43784378
int may_overflow)
43794379
{
4380+
bool must_set_cflags = 0;
43804381
bool same_ops = zend_jit_same_addr(op1_addr, op2_addr);
43814382
zend_reg result_reg;
43824383
zend_reg tmp_reg = ZREG_R0;
@@ -4399,34 +4400,63 @@ static int zend_jit_math_long_long(dasm_State **Dst,
43994400
tmp_reg = ZREG_FCARG1;
44004401
}
44014402

4403+
if (may_overflow) {
4404+
must_set_cflags = 1;
4405+
} else {
4406+
const zend_op *next_opline = opline + 1;
4407+
4408+
if (next_opline->opcode == ZEND_IS_EQUAL ||
4409+
next_opline->opcode == ZEND_IS_NOT_EQUAL ||
4410+
next_opline->opcode == ZEND_IS_SMALLER ||
4411+
next_opline->opcode == ZEND_IS_SMALLER_OR_EQUAL ||
4412+
next_opline->opcode == ZEND_CASE ||
4413+
next_opline->opcode == ZEND_IS_IDENTICAL ||
4414+
next_opline->opcode == ZEND_IS_NOT_IDENTICAL ||
4415+
next_opline->opcode == ZEND_CASE_STRICT) {
4416+
if (next_opline->op1_type == IS_CONST
4417+
&& Z_TYPE_P(RT_CONSTANT(next_opline, next_opline->op1)) == IS_LONG
4418+
&& Z_LVAL_P(RT_CONSTANT(next_opline, next_opline->op1)) == 0
4419+
&& next_opline->op2_type == opline->result_type
4420+
&& next_opline->op2.var == opline->result.var) {
4421+
must_set_cflags = 1;
4422+
} else if (next_opline->op2_type == IS_CONST
4423+
&& Z_TYPE_P(RT_CONSTANT(next_opline, next_opline->op2)) == IS_LONG
4424+
&& Z_LVAL_P(RT_CONSTANT(next_opline, next_opline->op2)) == 0
4425+
&& next_opline->op2_type == opline->result_type
4426+
&& next_opline->op2.var == opline->result.var) {
4427+
must_set_cflags = 1;
4428+
}
4429+
}
4430+
}
4431+
44024432
if (opcode == ZEND_MUL &&
44034433
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
44044434
Z_LVAL_P(Z_ZV(op2_addr)) == 2) {
4405-
if (Z_MODE(op1_addr) == IS_REG && !may_overflow) {
4435+
if (Z_MODE(op1_addr) == IS_REG && !must_set_cflags) {
44064436
| lea Ra(result_reg), [Ra(Z_REG(op1_addr))+Ra(Z_REG(op1_addr))]
44074437
} else {
44084438
| GET_ZVAL_LVAL result_reg, op1_addr
44094439
| add Ra(result_reg), Ra(result_reg)
44104440
}
44114441
} else if (opcode == ZEND_MUL &&
44124442
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
4413-
!may_overflow &&
4443+
!must_set_cflags &&
44144444
Z_LVAL_P(Z_ZV(op2_addr)) > 0 &&
44154445
zend_long_is_power_of_two(Z_LVAL_P(Z_ZV(op2_addr)))) {
44164446
| GET_ZVAL_LVAL result_reg, op1_addr
44174447
| shl Ra(result_reg), zend_long_floor_log2(Z_LVAL_P(Z_ZV(op2_addr)))
44184448
} else if (opcode == ZEND_MUL &&
44194449
Z_MODE(op1_addr) == IS_CONST_ZVAL &&
44204450
Z_LVAL_P(Z_ZV(op1_addr)) == 2) {
4421-
if (Z_MODE(op2_addr) == IS_REG && !may_overflow) {
4451+
if (Z_MODE(op2_addr) == IS_REG && !must_set_cflags) {
44224452
| lea Ra(result_reg), [Ra(Z_REG(op2_addr))+Ra(Z_REG(op2_addr))]
44234453
} else {
44244454
| GET_ZVAL_LVAL result_reg, op2_addr
44254455
| add Ra(result_reg), Ra(result_reg)
44264456
}
44274457
} else if (opcode == ZEND_MUL &&
44284458
Z_MODE(op1_addr) == IS_CONST_ZVAL &&
4429-
!may_overflow &&
4459+
!must_set_cflags &&
44304460
Z_LVAL_P(Z_ZV(op1_addr)) > 0 &&
44314461
zend_long_is_power_of_two(Z_LVAL_P(Z_ZV(op1_addr)))) {
44324462
| GET_ZVAL_LVAL result_reg, op2_addr
@@ -4437,19 +4467,19 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44374467
| GET_ZVAL_LVAL result_reg, op1_addr
44384468
| shr Ra(result_reg), zend_long_floor_log2(Z_LVAL_P(Z_ZV(op2_addr)))
44394469
} else if (opcode == ZEND_ADD &&
4440-
!may_overflow &&
4470+
!must_set_cflags &&
44414471
Z_MODE(op1_addr) == IS_REG &&
44424472
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
44434473
IS_SIGNED_32BIT(Z_LVAL_P(Z_ZV(op2_addr)))) {
44444474
| lea Ra(result_reg), [Ra(Z_REG(op1_addr))+Z_LVAL_P(Z_ZV(op2_addr))]
44454475
} else if (opcode == ZEND_ADD &&
4446-
!may_overflow &&
4476+
!must_set_cflags &&
44474477
Z_MODE(op2_addr) == IS_REG &&
44484478
Z_MODE(op1_addr) == IS_CONST_ZVAL &&
44494479
IS_SIGNED_32BIT(Z_LVAL_P(Z_ZV(op1_addr)))) {
44504480
| lea Ra(result_reg), [Ra(Z_REG(op2_addr))+Z_LVAL_P(Z_ZV(op1_addr))]
44514481
} else if (opcode == ZEND_SUB &&
4452-
!may_overflow &&
4482+
!must_set_cflags &&
44534483
Z_MODE(op1_addr) == IS_REG &&
44544484
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
44554485
IS_SIGNED_32BIT(-Z_LVAL_P(Z_ZV(op2_addr)))) {

‎ext/opcache/tests/jit/gh12382.phpt

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
--TEST--
2+
GH-12382: JIT Index invalid or out of range error
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
--FILE--
7+
<?php
8+
function applyMaskPenaltyRule3(SplFixedArray $array) : void
9+
{
10+
for ($y = 0; $y < 21; ++$y) {
11+
for ($x = 0; $x < 21; ++$x) {
12+
if (
13+
(
14+
$x + 10 < 21
15+
&& 0 === $array[$y][$x + 7]
16+
)
17+
|| (
18+
$x - 4 >= 0
19+
&& 0 === $array[$y][$x - 1]
20+
)
21+
) {
22+
}
23+
}
24+
}
25+
}
26+
27+
$matrix = SplFixedArray::fromArray(
28+
array_map(
29+
fn (array $arr): SplFixedArray => SplFixedArray::fromArray($arr),
30+
[[1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, ], [1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, ], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ], [0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, ], [0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, ], [0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, ], [1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, ], [1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, ], [0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, ], [1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, ], [1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, ], [1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, ], [1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, ], ]
31+
)
32+
);
33+
34+
applyMaskPenaltyRule3($matrix);
35+
applyMaskPenaltyRule3($matrix);
36+
?>
37+
DONE
38+
--EXPECT--
39+
DONE

0 commit comments

Comments
 (0)
Please sign in to comment.