Core dumped where try Zval::set_string with persist trye

[Norbytus]

use ext_php_rs::prelude::*;
use ext_php_rs::types::Zval;

pub fn startup(_ty: i32, _: i32) -> i32 {
    0
}

#[php_class]
#[derive(Default)]
struct Test {}

#[php_impl]
impl Test {
    #[php(constructor)]
    fn __constructor() -> Self {
        Self {}
    }
    fn test(&self) {
        let mut z = Zval::new();
        let _ = z.set_string("TEST", true);
    }
}

#[php_module]
fn module(module: ModuleBuilder) -> ModuleBuilder {
    module.class::<Test>()
}

<?php

$t = new Test;

var_dump($t->test());

Output

zend_mm_heap corrupted
[2]    41472 IOT instruction (core dumped)  php -d extension=./target/debug/libtest_php_ext.so ./index.php

OS: Archlinux

[Xenira]

So this is weird. My first guess was that our freeing logic caused this.

But when I do this it works

$foo = persistent_string();
var_dump($foo);
assert($foo === "Foo");

but when I use it directly it has corrupted heap

assert(persistent_string() === "Foo");

[Norbytus]

So this is weird. My first guess was that our freeing logic caused this.

But when I do this it works

$foo = persistent_string();
var_dump($foo);
assert($foo === "Foo");

but when I use it directly it has corrupted heap

assert(persistent_string() === "Foo");

I dont know how it works in this example. But in php source said, that persist flag can be useed to save value between requests.
So i try run with php server like this.

php -d extension=./target/debug/libstring_error_php.so -S localhost:9999 index.php

And it's work fine, So probably its not bug i think, cause it's depends on context how you run code.
But again in php source they have different function to alloc zend_string

https://github.com/php/php-src/blob/4a98b36416a8ebe0964d2e6ceca435c0d7f3f065/Zend/zend_string.h#L174

zend_string_alloc
zend_string_init
zend_string_init_fast
zend_string_safe_alloc

So i think there should be opportunity, some how chose witch function call where declare a String.

What do you think @Xenira ?

[Xenira]

@Norbytus yeah, its not meant for cli use. Still strange, that it works sometimes. Maybe it just has undefined behaviour when not used in request context.

Will leave this open for now and ask over at php-src if I have time.

[kakserpom]

I've just looked into it a bit and it all makes sense.

The issue here is that the Zval is being dropped immediately while holding the persistent ZendStr which is never dropped because ZBox<ZendStr>::into_raw() is called to set the str_. And because ZendStr is never dropped, zend_string_release is never called which causes a heap corruption.

If we change the snippet a bit to return the Zval:

    fn test(&self) -> Zval {
        let mut zval = Zval::new();
        let _ = zval.set_string("TEST", true);
        zval
    }

It will still corrupt the heap like this:

string(4) "TEST"
zend_mm_heap corrupted

But if we change the PHP code to

<?php
$t = new Test;
$a = $t->test();
var_dump($a);

It will work fine because $a lives until termination and the Zval is never dropped.

I would suggest checking SAPI and forcing persistent to false if the SAPI in use doesn't support persistent values.