clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 09:57:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix use-after-free in property coercion with __toString()
This commit is contained in:
Ilija Tovilo 2024-07-16 12:43:29 +02:00
commit aca2322801
No known key found for this signature in database
GPG Key ID: 5050C66BFCD1015A
3 changed files with 51 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -10,6 +10,8 @@ PHP NEWS
(nielsdos)
. Fixed OSS-Fuzz #69765. (nielsdos)
. Fixed bug GH-14741 (Segmentation fault in Zend/zend_types.h). (nielsdos)
. Fixed bug GH-14969 (Use-after-free in property coercion with __toString()).
(ilutov)
- Dom:
. Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)

47
Zend/tests/gh14969.phpt Normal file
View File

@ -0,0 +1,47 @@
--TEST--
GH-14969: Crash on coercion with throwing __toString()
--FILE--
<?php
class C {
public function __toString() {
global $c;
$c = [];
throw new Exception(__METHOD__);
}
}
class D {
public string $prop;
}
$c = new C();
$d = new D();
try {
$d->prop = $c;
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
var_dump($d);
$c = new C();
$d->prop = 'foo';
try {
$d->prop = $c;
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
var_dump($d);
?>
--EXPECTF--
C::__toString
object(D)#%d (0) {
["prop"]=>
uninitialized(string)
}
C::__toString
object(D)#2 (1) {
["prop"]=>
string(3) "foo"
}

4
Zend/zend_object_handlers.c
View File

@ -846,7 +846,7 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva
goto exit;
}
if (UNEXPECTED(!type_matched)) {
Z_TRY_DELREF_P(value);
zval_ptr_dtor(&tmp);
variable_ptr = &EG(error_zval);
goto exit;
}
@ -949,7 +949,7 @@ write_std_property:
goto exit;
}
if (UNEXPECTED(!type_matched)) {
zval_ptr_dtor(value);
zval_ptr_dtor(&tmp);
goto exit;
}
value = &tmp;