Skip to content

Instantly share code, notes, and snippets.

@lisachenko
Created Oct 30, 2019
Embed
What would you like to do?
FFI::cast proxying zend_mm_heap corruption
<?php
declare(strict_types=1);
use FFI\CData;
class Core
{
private static FFI $engine;
public static CData $executor;
public static function init()
{
self::$engine = $engine = FFI::scope('PHP');
self::$executor = $engine->executor_globals;
}
public static function cast(string $type, CData $pointer): CData
{
return self::$engine->cast($type, $pointer);
}
}
#define FFI_SCOPE "PHP"
#define FFI_LIB "php7.dll"
struct _zend_executor_globals {
};
typedef struct _zend_executor_globals zend_executor_globals;
extern zend_executor_globals executor_globals;
<?php
include_once __DIR__ . '/Core.php';
FFI::load(__DIR__ . '/header.h');
Core::init();
<?php
include_once __DIR__ . '/Core.php';
Core::init();
$global = Core::$executor; // <=== On this line everything is OK
Core::cast('char[10]', $global); // zend_mm_heap corrupted
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment