Move locks in TSRM.c to prevent races

Closes GH-8298.
php · Apr 11, 2022 · 1a75269 · 1a75269
1 parent 84c18f9
commit 1a75269
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/NEWS b/NEWS
@@ -21,6 +21,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-8070 (memory leak of internal function attribute hash).
     (Tim Düsterhus)
   . Fixed bug GH-8160 (ZTS support on Alpine is broken). (Michael Voříšek)
+  . Fixed potential race condition during resource ID allocation. (ryancaicse)
 
 - Filter:
   . Fixed signedness confusion in php_filter_validate_domain(). (cmb)

diff --git a/TSRM/TSRM.c b/TSRM/TSRM.c
@@ -288,9 +288,9 @@ TSRM_API ts_rsrc_id ts_allocate_id(ts_rsrc_id *rsrc_id, size_t size, ts_allocate
 		tsrm_resource_type *_tmp;
 		_tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count);
 		if (!_tmp) {
-			tsrm_mutex_unlock(tsmm_mutex);
 			TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource"));
 			*rsrc_id = 0;
+			tsrm_mutex_unlock(tsmm_mutex);
 			return 0;
 		}
 		resource_types_table = _tmp;
@@ -331,10 +331,10 @@ TSRM_API ts_rsrc_id ts_allocate_fast_id(ts_rsrc_id *rsrc_id, size_t *offset, siz
 
 	size = TSRM_ALIGNED_SIZE(size);
 	if (tsrm_reserved_size - tsrm_reserved_pos < size) {
-		tsrm_mutex_unlock(tsmm_mutex);
 		TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate space for fast resource"));
 		*rsrc_id = 0;
 		*offset = 0;
+		tsrm_mutex_unlock(tsmm_mutex);
 		return 0;
 	}
 
@@ -346,9 +346,9 @@ TSRM_API ts_rsrc_id ts_allocate_fast_id(ts_rsrc_id *rsrc_id, size_t *offset, siz
 		tsrm_resource_type *_tmp;
 		_tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count);
 		if (!_tmp) {
-			tsrm_mutex_unlock(tsmm_mutex);
 			TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource"));
 			*rsrc_id = 0;
+			tsrm_mutex_unlock(tsmm_mutex);
 			return 0;
 		}
 		resource_types_table = _tmp;