Opened 4 years ago

Closed 4 years ago

#256 closed defect (fixed)

xcache crashes during module shutdown when used together with ionCube Loader

Reported by: nijel Owned by: moo
Priority: major Milestone:
Component: cacher Version: 1.3.1
Keywords: Cc:
Application: PHP Version:
Other Exts: SAPI: Irrelevant
Probability: Always Blocked By:
Blocking:

Description

When xcache is loaded a s a PHP extension:

extension=xcache.so

Any attempt to execute an ionCube-encoded file crashes PHP w/backtrace like this:

#0 zm_shutdown_xcache (type=<value optimized out>, module_number=53) at /build/buildd/php5-xcache-1.3.1/xcache.c:2968
#1 0x000000000069c2df in module_destructor (module=0xf0d3a0) at /build/buildd/php5-5.3.3/Zend/zend_API.c:2098
#2 0x00000000006a30e1 in zend_hash_apply_deleter (ht=0xdc0760, p=0xf0d340) at /build/buildd/php5-5.3.3/Zend/zend_hash.c:813
#3 0x00000000006a3368 in zend_hash_graceful_reverse_destroy (ht=0xdc0760) at /build/buildd/php5-5.3.3/Zend/zend_hash.c:848
#4 0x0000000000697045 in zend_shutdown () at /build/buildd/php5-5.3.3/Zend/zend.c:831
#5 0x00000000006427ed in php_module_shutdown () at /build/buildd/php5-5.3.3/main/main.c:2166
#6 0x000000000072625f in main (argc=-1969359736, argv=0x0) at /build/buildd/php5-5.3.3/sapi/cli/php_cli.c:1391

This happens because xCache does not validate the result of

zend_extension *ext = zend_get_extension(XCACHE_NAME);

called in zm_shutdown_xcache (PHP_MSHUTDOWN_FUNCTION(xcache))

I don't know what ionCube Loader does but zend_get_extension(XCACHE_NAME) returns NULL in this case.

When xcache tries to dereference a NULL pointer in

if (ext->shutdown) {

we get a crash.

Attachments (1)

check-extension-is-null (410 bytes) - added by nijel 4 years ago.
Patch fixing this

Download all attachments as: .zip

Change History (3)

Changed 4 years ago by nijel

Patch fixing this

comment:2 Changed 4 years ago by moo

  • Resolution set to fixed
  • Status changed from new to closed

fixed in [698] for trunk and and in [701] for 1.3.x

not sure if it's still clean shutdown

Note: See TracTickets for help on using tickets.