Skip to content

Commit bb299a0

Browse files
committed
Merge branch 'PHP-8.3'
* PHP-8.3: Fix crash when converting array data for array in shm in xxh3
2 parents a0c29f0 + c38c6ac commit bb299a0

File tree

2 files changed

+21
-3
lines changed

2 files changed

+21
-3
lines changed

ext/hash/hash_xxhash.c

+7-3
Original file line numberDiff line numberDiff line change
@@ -174,19 +174,23 @@ zend_always_inline static void _PHP_XXH3_Init(PHP_XXH3_64_CTX *ctx, HashTable *a
174174
func_init_seed(&ctx->s, (XXH64_hash_t)Z_LVAL_P(_seed));
175175
return;
176176
} else if (_secret) {
177-
if (!try_convert_to_string(_secret)) {
177+
zend_string *secret_string = zval_try_get_string(_secret);
178+
if (UNEXPECTED(!secret_string)) {
179+
ZEND_ASSERT(EG(exception));
178180
return;
179181
}
180-
size_t len = Z_STRLEN_P(_secret);
182+
size_t len = ZSTR_LEN(secret_string);
181183
if (len < PHP_XXH3_SECRET_SIZE_MIN) {
184+
zend_string_release(secret_string);
182185
zend_throw_error(NULL, "%s: Secret length must be >= %u bytes, %zu bytes passed", algo_name, XXH3_SECRET_SIZE_MIN, len);
183186
return;
184187
}
185188
if (len > sizeof(ctx->secret)) {
186189
len = sizeof(ctx->secret);
187190
php_error_docref(NULL, E_WARNING, "%s: Secret content exceeding %zu bytes discarded", algo_name, sizeof(ctx->secret));
188191
}
189-
memcpy((unsigned char *)ctx->secret, Z_STRVAL_P(_secret), len);
192+
memcpy((unsigned char *)ctx->secret, ZSTR_VAL(secret_string), len);
193+
zend_string_release(secret_string);
190194
func_init_secret(&ctx->s, ctx->secret, len);
191195
return;
192196
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
xxh3 convert secret to string should not modify (shm) array
3+
--FILE--
4+
<?php
5+
try {
6+
hash_init("xxh3", options: $x = ["secret" => 4]);
7+
} catch (Throwable) {}
8+
var_dump($x);
9+
?>
10+
--EXPECT--
11+
array(1) {
12+
["secret"]=>
13+
int(4)
14+
}

0 commit comments

Comments
 (0)