Skip to content

Commit 998ede7

Browse files
authored
Fix segmentation fault in Randomizer::getBytes() if a user engine throws (#9055)
This fixes: ==374077== Use of uninitialised value of size 8 ==374077== at 0x532B06: generate (engine_user.c:39) ==374077== by 0x533F71: zim_Random_Randomizer_getBytes (randomizer.c:152) ==374077== by 0x7F581D: ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1885) ==374077== by 0x8725BE: execute_ex (zend_vm_execute.h:55930) ==374077== by 0x877DB4: zend_execute (zend_vm_execute.h:60253) ==374077== by 0x7B0FD4: zend_execute_scripts (zend.c:1770) ==374077== by 0x6F1647: php_execute_script (main.c:2535) ==374077== by 0x937DA4: do_cli (php_cli.c:964) ==374077== by 0x938C3A: main (php_cli.c:1333) ==374077== ==374077== Invalid read of size 8 ==374077== at 0x532B06: generate (engine_user.c:39) ==374077== by 0x533F71: zim_Random_Randomizer_getBytes (randomizer.c:152) ==374077== by 0x7F581D: ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1885) ==374077== by 0x8725BE: execute_ex (zend_vm_execute.h:55930) ==374077== by 0x877DB4: zend_execute (zend_vm_execute.h:60253) ==374077== by 0x7B0FD4: zend_execute_scripts (zend.c:1770) ==374077== by 0x6F1647: php_execute_script (main.c:2535) ==374077== by 0x937DA4: do_cli (php_cli.c:964) ==374077== by 0x938C3A: main (php_cli.c:1333) ==374077== Address 0x11 is not stack'd, malloc'd or (recently) free'd
1 parent 5c2c688 commit 998ede7

File tree

3 files changed

+53
-0
lines changed

3 files changed

+53
-0
lines changed

ext/random/engine_user.c

+5
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ static uint64_t generate(php_random_status *status)
3030

3131
zend_call_known_instance_method_with_0_params(s->generate_method, s->object, &retval);
3232

33+
if (EG(exception)) {
34+
status->last_unsafe = true;
35+
return 0;
36+
}
37+
3338
/* Store generated size in a state */
3439
size = Z_STRLEN(retval);
3540

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
--TEST--
2+
Random: Randomizer: User: Engine exits
3+
--FILE--
4+
<?php
5+
6+
$randomizer = (new \Random\Randomizer(
7+
new class () implements \Random\Engine {
8+
public function generate(): string
9+
{
10+
exit("Exit\n");
11+
}
12+
}
13+
));
14+
15+
var_dump($randomizer->getBytes(1));
16+
17+
?>
18+
--EXPECT--
19+
Exit
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
--TEST--
2+
Random: Randomizer: User: Engine throws
3+
--FILE--
4+
<?php
5+
6+
$randomizer = (new \Random\Randomizer(
7+
new class () implements \Random\Engine {
8+
public function generate(): string
9+
{
10+
throw new Exception('Error');
11+
}
12+
}
13+
));
14+
15+
var_dump($randomizer->getBytes(1));
16+
17+
?>
18+
--EXPECTF--
19+
Fatal error: Uncaught Exception: Error in %s:%d
20+
Stack trace:
21+
#0 [internal function]: Random\Engine@anonymous->generate()
22+
#1 %s(%d): Random\Randomizer->getBytes(1)
23+
#2 {main}
24+
25+
Next RuntimeException: Random number generation failed in %s:%d
26+
Stack trace:
27+
#0 %s(%d): Random\Randomizer->getBytes(1)
28+
#1 {main}
29+
thrown in %s on line %d

0 commit comments

Comments
 (0)