ptondereau / ext-php-rs / 24792373762

66%

master: 66%

push

github

fix: heap corruption when returning Binary of 0/1 packed bytes

Returning a Binary from a #[php_function] crashed PHP with "zend_mm_heap corrupted" when the packed byte length was 0 or 1. This was a regression introduced in 0.15.8 by PR #701, which short-circuits ext_php_rs_zend_string_init to return PHP's interned permanent statics (zend_empty_string, zend_one_char_string[c]) for length 0 and 1. Zval::set_zend_string was updated in that PR to detect these statics via GC_IMMUTABLE and flag the zval as InternedStringEx, but Zval::set_binary was missed and always flagged the zval as refcounted. On drop PHP tried to free a process-global static, leading to heap corruption.

Zval::set_binary now wraps the raw pointer from Pack::pack_into in ZBox<ZendStr> and delegates to set_zend_string, so every path that assigns a zend_string to a zval shares one flag-selection site, matching PHP's own ZVAL_STR macro in Zend/zend_types.h.

Also tightened the NULL guard in wrapper.c so the fast path is safe when only one of the two weak symbols resolves at link time, and fixed an adjacent correctness issue where Zval::binary::<T>() and Zval::binary_slice::<T>() silently truncated trailing bytes when the byte length was not a multiple of size_of::<T>(). Both functions now return None in that case rather than dropping data.

Fixes #729

67 of 73 new or added lines in 1 file covered. (91.78%)

8653 of 13063 relevant lines covered (66.24%)

33.15 hits per line