php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-18 21:41:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.4'

Browse Source 
* PHP-7.4:
  Fix early free of assign_obj op_data
This commit is contained in:
Nikita Popov
2019-12-20 10:35:50 +01:00
parent 2ab123b84e 885b3451f4
commit 0d8ebbaa73
3 changed files with 310 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
Zend/tests/overloaded_assign_prop_return_value.phpt Normal file
View File

@@ -0,0 +1,14 @@
--TEST--
Make sure the return value of a property assignment is not freed to early
--FILE--
<?php
class Overloaded {
function __set($r, $a) {}
}
$obj = new Overloaded;
$x = $obj->prop = new stdClass;
var_dump($x);
?>
--EXPECT--
object(stdClass)#2 (0) {
}

10
Zend/zend_vm_def.h
View File

@@ -2377,6 +2377,9 @@ ZEND_VM_C_LABEL(assign_object):
} else {
ZEND_VM_C_LABEL(fast_assign_obj):
value = zend_assign_to_variable(property_val, value, OP_DATA_TYPE, EX_USES_STRICT_TYPES());
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_COPY(EX_VAR(opline->result.var), value);
}
ZEND_VM_C_GOTO(exit_assign_obj);
}
}
@@ -2424,6 +2427,9 @@ ZEND_VM_C_LABEL(fast_assign_obj):
}
}
zend_hash_add_new(zobj->properties, Z_STR_P(property), value);
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_COPY(EX_VAR(opline->result.var), value);
}
ZEND_VM_C_GOTO(exit_assign_obj);
}
}
@@ -2451,11 +2457,11 @@ ZEND_VM_C_LABEL(fast_assign_obj):
}
ZEND_VM_C_LABEL(free_and_exit_assign_obj):
FREE_OP_DATA();
ZEND_VM_C_LABEL(exit_assign_obj):
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_COPY(EX_VAR(opline->result.var), value);
}
FREE_OP_DATA();
ZEND_VM_C_LABEL(exit_assign_obj):
FREE_OP2();
FREE_OP1_VAR_PTR();
/* assign_obj has two opcodes! */

360
Zend/zend_vm_execute.h
View File

File diff suppressed because it is too large Load Diff