1
0
mirror of https://github.com/php/php-src.git synced 2026-04-26 09:28:21 +02:00

Merge branch 'PHP-8.1'

* PHP-8.1:
  Fix use after free
This commit is contained in:
Dmitry Stogov
2022-06-14 12:50:16 +03:00
2 changed files with 16 additions and 1 deletions
@@ -0,0 +1,15 @@
--TEST--
User streams and incrrectly typed context
--FILE--
<?php
class Wrapper {
public Foo $context;
}
if (stream_wrapper_register('foo', Wrapper::class)) dir('foo://');
?>
--EXPECTF--
Fatal error: Uncaught TypeError: Cannot assign resource to property Wrapper::$context of type Foo in %suser_streams_context_001.php:5
Stack trace:
#0 %suser_streams_context_001.php(5): dir('foo://')
#1 {main}
thrown in %suser_streams_context_001.php on line 5
+1 -1
View File
@@ -298,8 +298,8 @@ static void user_stream_create_object(struct php_user_stream_wrapper *uwrap, php
}
if (context) {
add_property_resource(object, "context", context->res);
GC_ADDREF(context->res);
add_property_resource(object, "context", context->res);
} else {
add_property_null(object, "context");
}