clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 10:27:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Check next_index_insert failure in ADD_ARRAY_ELEMENT

Browse Source
This commit is contained in:
Nikita Popov 2016-09-28 22:33:40 +02:00
parent 4f0960a800
commit 99bf19c177
3 changed files with 100 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Zend/tests/array_literal_next_element_error.phpt Normal file
View File

@ -0,0 +1,16 @@
--TEST--
Next free element may overflow in array literals
--FILE--
<?php
$i = PHP_INT_MAX;
$array = [$i => 42, new stdClass];
var_dump($array);
?>
--EXPECTF--
Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
array(1) {
[%d]=>
int(42)
}

5
Zend/zend_vm_def.h
View File

@ -3879,7 +3879,10 @@ ZEND_VM_C_LABEL(num_index):
}
FREE_OP2();
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) && opline->extended_value) {
FREE_OP1_VAR_PTR();

100
Zend/zend_vm_execute.h
View File

@ -4119,7 +4119,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
@ -5030,7 +5033,10 @@ num_index:
}
zval_dtor(free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
@ -5894,7 +5900,10 @@ num_index:
}
zval_ptr_dtor_nogc(&free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
@ -6614,7 +6623,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
@ -7547,7 +7559,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {
@ -9447,7 +9462,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
@ -10314,7 +10332,10 @@ num_index:
}
zval_dtor(free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
@ -11180,7 +11201,10 @@ num_index:
}
zval_ptr_dtor_nogc(&free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
@ -11775,7 +11799,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
@ -12624,7 +12651,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {
@ -16107,7 +16137,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@ -18387,7 +18420,10 @@ num_index:
}
zval_dtor(free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@ -20725,7 +20761,10 @@ num_index:
}
zval_ptr_dtor_nogc(&free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@ -22165,7 +22204,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@ -24220,7 +24262,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@ -33574,7 +33619,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
@ -35717,7 +35765,10 @@ num_index:
}
zval_dtor(free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
@ -37917,7 +37968,10 @@ num_index:
}
zval_ptr_dtor_nogc(&free_op2.var);
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
@ -39225,7 +39279,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {
@ -41125,7 +41182,10 @@ num_index:
}
} else {
zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
zval_ptr_dtor(&expr_ptr);
}
}
if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {