mirror of
https://github.com/php/php-src.git
synced 2024-09-21 01:47:25 +00:00
The return value of zho_build_properties_ex() is passed to ZVAL_ARR(), which sets the IS_TYPE_REFCOUNTED flag. Returning &zend_emtpy_array will crash later when trying to dtor the zval. I'm fixing this by returning zend_new_array(0) instead of &zend_empty_array. An alternative was to make ZVAL_ARR() aware of immutable arrays, like ZVAL_STR() is with interned strings, but I found no other problematic cases.
This commit is contained in:
parent
1ce865244a
commit
17d46bb3b2
27
Zend/tests/lazy_objects/oss_fuzz_71382.phpt
Normal file
27
Zend/tests/lazy_objects/oss_fuzz_71382.phpt
Normal file
@ -0,0 +1,27 @@
|
||||
--TEST--
|
||||
oss-fuzz #71382
|
||||
--FILE--
|
||||
<?php
|
||||
|
||||
class C {
|
||||
public $a;
|
||||
public $b {
|
||||
get {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$reflector = new ReflectionClass(C::class);
|
||||
$obj = $reflector->newLazyGhost(function() {
|
||||
throw new \Exception('initializer');
|
||||
});
|
||||
|
||||
try {
|
||||
foreach($obj as $a) {
|
||||
}
|
||||
} catch (Exception $e) {
|
||||
printf("%s: %s\n", $e::class, $e->getMessage());
|
||||
}
|
||||
|
||||
--EXPECT--
|
||||
Exception: initializer
|
@ -54,7 +54,7 @@ static zend_array *zho_build_properties_ex(zend_object *zobj, bool check_access,
|
||||
if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
|
||||
zobj = zend_lazy_object_init(zobj);
|
||||
if (UNEXPECTED(!zobj)) {
|
||||
return (zend_array*) &zend_empty_array;
|
||||
return zend_new_array(0);
|
||||
}
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user