clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 09:57:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.1' into PHP-8.2

Browse Source 
* PHP-8.1:
  Fix access on NULL pointer in array_merge_recursive()
This commit is contained in:
Ilija Tovilo 2023-05-24 13:37:47 +02:00
commit 4676d9bc43
No known key found for this signature in database
GPG Key ID: A4F5D403F118200A
5 changed files with 40 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -2,6 +2,8 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.2.8
- Standard:
. Fix access on NULL pointer in array_merge_recursive(). (ilutov)
01 Jun 2023, PHP 8.2.7

25
Zend/tests/array_merge_recursive_next_key_overflow.phpt Normal file
View File

@ -0,0 +1,25 @@
--TEST--
Access on NULL pointer in array_merge_recursive()
--FILE--
<?php
try {
array_merge_recursive(
['' => [PHP_INT_MAX => null]],
['' => [null]],
);
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
try {
array_merge_recursive(
['foo' => [PHP_INT_MAX => null]],
['foo' => str_repeat('a', 2)],
);
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
Cannot add element to the array as the next element is already occupied
Cannot add element to the array as the next element is already occupied

2
Zend/zend_execute.c
View File

@ -2194,7 +2194,7 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_scalar_as_array(v
zend_throw_error(NULL, "Cannot use a scalar value as an array");
}
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
ZEND_API zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
{
zend_throw_error(NULL, "Cannot add element to the array as the next element is already occupied");
}

2
Zend/zend_execute.h
View File

@ -76,6 +76,8 @@ ZEND_API ZEND_COLD void zend_wrong_string_offset_error(void);
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_modification_error(zend_property_info *info);
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_indirect_modification_error(zend_property_info *info);
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void);
ZEND_API bool zend_verify_scalar_type_hint(uint32_t type_mask, zval *arg, bool strict, bool is_internal_arg);
ZEND_API ZEND_COLD void zend_verify_arg_error(
const zend_function *zf, const zend_arg_info *arg_info, uint32_t arg_num, zval *value);

11
ext/standard/array.c
View File

@ -3728,7 +3728,12 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
}
} else {
Z_TRY_ADDREF_P(src_zval);
zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval);
zval *zv = zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval);
if (EXPECTED(!zv)) {
Z_TRY_DELREF_P(src_zval);
zend_cannot_add_element();
return 0;
}
}
zval_ptr_dtor(&tmp);
} else {
@ -3737,6 +3742,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
}
} else {
zval *zv = zend_hash_next_index_insert(dest, src_entry);
if (UNEXPECTED(!zv)) {
zend_cannot_add_element();
return 0;
}
zval_add_ref(zv);
}
} ZEND_HASH_FOREACH_END();