THRIFT-3984 PHP7 extension causes segfault
The PHP 7 extension can sometimes free strings it does not own,
when serializing string map keys, or the name of called methods.
The latter case was somewhat migitated since the double-free has no
effect on interned strings.
Using ZVAL_STR_COPY instead of ZVAL_STR will increment the reference
count, making the following destructor call correct.
Fix memory leak in PHP 7
Fix memory leak when deserializing maps or sets.
zend_hash_update will add its own reference to the key, so we need to
destruct the key zval to not leak.
We don't need to destruct the value, the hash table will take ownership
of it.
This closes #1152
diff --git a/test/php/TestClient.php b/test/php/TestClient.php
index c1f6435..76fd935 100755
--- a/test/php/TestClient.php
+++ b/test/php/TestClient.php
@@ -266,6 +266,39 @@
$exitcode |= ERR_CONTAINERS;
}
+$mapout = array();
+for ($i = 0; $i < 10; $i++) {
+ $mapout["key$i"] = "val$i";
+}
+print_r('testStringMap({');
+$first = true;
+foreach ($mapout as $key => $val) {
+ if ($first) {
+ $first = false;
+ } else {
+ print_r(", ");
+ }
+ print_r("\"$key\" => \"$val\"");
+}
+print_r("})");
+$mapin = $testClient->testStringMap($mapout);
+print_r(" = {");
+$first = true;
+foreach ($mapin as $key => $val) {
+ if ($first) {
+ $first = false;
+ } else {
+ print_r(", ");
+ }
+ print_r("\"$key\" => \"$val\"");
+}
+print_r("}\n");
+ksort($mapin);
+if ($mapin != $mapout) {
+ echo "**FAILED**\n";
+ $exitcode |= ERR_CONTAINERS;
+}
+
/**
* SET TEST
*/
@@ -459,7 +492,6 @@
print_r(' caught xception '.$x->errorCode.': '.$x->message."\n");
}
-
/**
* Normal tests done.
*/
@@ -472,6 +504,19 @@
* Extraneous "I don't trust PHP to pack/unpack integer" tests
*/
+if ($protocol instanceof TBinaryProtocolAccelerated) {
+ // Regression check: check that method name is not double-freed
+ // Method name should not be an interned string.
+ $method_name = "Void";
+ $method_name = "test$method_name";
+
+ $seqid = 0;
+ $args = new \ThriftTest\ThriftTest_testVoid_args();
+ thrift_protocol_write_binary($protocol, $method_name, \Thrift\Type\TMessageType::CALL, $args, $seqid, $protocol->isStrictWrite());
+ $testClient->recv_testVoid();
+
+}
+
// Max I32
$num = pow(2, 30) + (pow(2, 30) - 1);
roundtrip($testClient, 'testI32', $num);