ptondereau / ext-php-rs

66%

master: 66%

LAST BUILD ON BRANCH fix/729-binary-interned-heap-corruption

branch: fix/729-binary-interned-heap-corruption

CHANGE BRANCH

x

Reset

Sync Branches

• fix/729-binary-interned-heap-corruption
• feat/cache-slot-property-lookup
• feat/module-globals
• feat/sapi-trait-and-zts
• feat/static-property-descriptors
• fix/clippy-1-95-0
• fix/null-pointer-sapi-trampolines
• fix/string-prop-getter-zend-string-leak

Build # 24792373762

Build Type

push

github

Committed by ptondereau

Commit Message

fix: heap corruption when returning Binary of 0/1 packed bytes

Returning a Binary from a #[php_function] crashed PHP with "zend_mm_heap corrupted" when the packed byte length was 0 or 1. This was a regression introduced in 0.15.8 by PR #701, which short-circuits ext_php_rs_zend_string_init to return PHP's interned permanent statics (zend_empty_string, zend_one_char_string[c]) for length 0 and 1. Zval::set_zend_string was updated in that PR to detect these statics via GC_IMMUTABLE and flag the zval as InternedStringEx, but Zval::set_binary was missed and always flagged the zval as refcounted. On drop PHP tried to free a process-global static, leading to heap corruption.

Zval::set_binary now wraps the raw pointer from Pack::pack_into in ZBox<ZendStr> and delegates to set_zend_string, so every path that assigns a zend_string to a zval shares one flag-selection site, matching PHP's own ZVAL_STR macro in Zend/zend_types.h.

Also tightened the NULL guard in wrapper.c so the fast path is safe when only one of the two weak symbols resolves at link time, and fixed an adjacent correctness issue where Zval::binary::<T>() and Zval::binary_slice::<T>() silently truncated trailing bytes when the byte length was not a multiple of size_of::<T>(). Both functions now return None in that case rather than dropping data.

Fixes #729

Coverage Stats

67 of 73 new or added lines in 1 file covered. (91.78%)

8653 of 13063 relevant lines covered (66.24%)

33.15 hits per line