Skip to content

Instantly share code, notes, and snippets.

@lisachenko
Created October 30, 2019 11:17
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save lisachenko/f133184201aa3c63d58af9548bdd825a to your computer and use it in GitHub Desktop.
FFI::cast proxying zend_mm_heap corruption
<?php
declare(strict_types=1);
use FFI\CData;
class Core
{
private static FFI $engine;
public static CData $executor;
public static function init()
{
self::$engine = $engine = FFI::scope('PHP');
self::$executor = $engine->executor_globals;
}
public static function cast(string $type, CData $pointer): CData
{
return self::$engine->cast($type, $pointer);
}
}
#define FFI_SCOPE "PHP"
#define FFI_LIB "php7.dll"
struct _zend_executor_globals {
};
typedef struct _zend_executor_globals zend_executor_globals;
extern zend_executor_globals executor_globals;
<?php
include_once __DIR__ . '/Core.php';
FFI::load(__DIR__ . '/header.h');
Core::init();
<?php
include_once __DIR__ . '/Core.php';
Core::init();
$global = Core::$executor; // <=== On this line everything is OK
Core::cast('char[10]', $global); // zend_mm_heap corrupted
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment