Skip to content

Fix GH-18173: ext/hash relies on implementation-defined malloc alignment#21668

Open
iliaal wants to merge 1 commit intophp:PHP-8.4from
iliaal:fix/gh-18173-hash-context-alignment-84
Open

Fix GH-18173: ext/hash relies on implementation-defined malloc alignment#21668
iliaal wants to merge 1 commit intophp:PHP-8.4from
iliaal:fix/gh-18173-hash-context-alignment-84

Conversation

@iliaal
Copy link
Copy Markdown
Contributor

@iliaal iliaal commented Apr 7, 2026

Summary

XXH3_state_t requires 64-byte alignment for its internal buffers. php_hash_alloc_context() used ecalloc(), which only guarantees alignof(max_align_t) (16 bytes on x86_64). When the allocator returned a pointer that wasn't 64-byte aligned, xxhash's aligned loads segfaulted.

Adds a context_align field to php_hash_ops. When non-zero, php_hash_alloc_context() over-allocates and manually aligns the pointer, storing the offset byte so php_hash_free_context() can recover the original allocation. Set to 64 for xxh3 and xxh128.

Reproduce with ZEND_MM_DEBUG=padding=8 TESTS=ext/hash make test.

…gnment

XXH3_state_t requires 64-byte alignment for its acc, customSecret, and
buffer members. php_hash_alloc_context() used ecalloc() which only
guarantees alignof(max_align_t) alignment -- typically 16 bytes on
x86_64. When heap layout broke that assumption, xxhash's aligned loads
would segfault.

Add a context_align field to php_hash_ops. When set, php_hash_alloc_context()
over-allocates and manually aligns the returned pointer, storing the
offset for php_hash_free_context() to recover the original allocation.
@iliaal iliaal force-pushed the fix/gh-18173-hash-context-alignment-84 branch from b6d6106 to 1db4b19 Compare April 8, 2026 11:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant