Page MenuHomePhabricator

PHP 7 object layout/allocation error in LuaSandbox
Closed, ResolvedPublic

Description

I was reading http://nikic.github.io/2015/06/19/Internal-value-representation-in-PHP-7-part-2.html , and I realised that the way we do custom objects in LuaSandbox is almost certainly wrong. In PHP 7 the zend_object header is supposed to come after the custom data, not before it as in PHP 5. Converting from a zend_object* to a the custom struct is meant to be done not by simple casting, but by subtracting the offset. See for example ext/tidy, which has:

struct _PHPTidyObj {
	TidyNode		node;
	tidy_obj_type	type;
	PHPTidyDoc		*ptdoc;
	zend_object		std;
};

static inline PHPTidyObj *php_tidy_fetch_object(zend_object *obj) {
	return (PHPTidyObj *)((char*)(obj) - XtOffsetOf(PHPTidyObj, std));
}

The inline function is pretty ugly, it could easily be cleaned up with a macro, but this is how all the in-tree extensions do it.

Event Timeline

Change 462744 had a related patch set uploaded (by Anomie; owner: Anomie):
[mediawiki/php/luasandbox@master] Fix PHP 7 object layout

https://gerrit.wikimedia.org/r/462744

Change 462744 merged by jenkins-bot:
[mediawiki/php/luasandbox@master] Fix PHP 7 object layout

https://gerrit.wikimedia.org/r/462744

Does this merit a new bugfix release/tag?

At some point yes. We may or may not find more bugs to fix if https://marc.info/?l=pecl-dev&m=153776610925078&w=2 gets feedback.