php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix OSS Fuzz #60734: use-after-free visible in ASAN build

Browse Source
This commit is contained in:
George Peter Banyard
2023-07-24 16:15:57 +01:00
parent 6ae9cf40d1
commit 2fbec0974f
6 changed files with 142 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
Zend/tests/in-de-crement/object_cannot_incdec.phpt Normal file
View File

@@ -0,0 +1,45 @@
--TEST--
Cannot increment/decrement objects
--FILE--
<?php
class Foo { }
$o = new Foo;
try {
$o++;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
try {
$o--;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
try {
++$o;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
try {
--$o;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
?>
--EXPECT--
Cannot increment Foo
object(Foo)#1 (0) {
}
Cannot decrement Foo
object(Foo)#1 (0) {
}
Cannot increment Foo
object(Foo)#1 (0) {
}
Cannot decrement Foo
object(Foo)#1 (0) {
}

45
Zend/tests/in-de-crement/object_cannot_incdec_use_result_op.phpt Normal file
View File

@@ -0,0 +1,45 @@
--TEST--
Cannot increment/decrement objects
--FILE--
<?php
class Foo { }
$o = new Foo;
try {
$y = $o++;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
try {
$y = $o--;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
try {
$y = ++$o;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
try {
$y = --$o;
} catch (\TypeError $e) {
echo $e->getMessage(), PHP_EOL;
var_dump($o);
}
?>
--EXPECT--
Cannot increment Foo
object(Foo)#1 (0) {
}
Cannot decrement Foo
object(Foo)#1 (0) {
}
Cannot increment Foo
object(Foo)#1 (0) {
}
Cannot decrement Foo
object(Foo)#1 (0) {
}

14
Zend/tests/in-de-crement/oss-fuzz-60734_predec-object.phpt Normal file
View File

@@ -0,0 +1,14 @@
--TEST--
OSS Fuzz #60734: use-after-free visible in ASAN build pre decrement.
--FILE--
<?php
class Foo{
}
$test = new Foo;
$y = --$test;
?>
--EXPECTF--
Fatal error: Uncaught TypeError: Cannot decrement Foo in %s:%d
Stack trace:
#0 {main}
thrown in %s on line %d

14
Zend/tests/in-de-crement/oss-fuzz-60734_preinc-object.phpt Normal file
View File

@@ -0,0 +1,14 @@
--TEST--
OSS Fuzz #60734: use-after-free visible in ASAN build pre increment.
--FILE--
<?php
class Foo{
}
$test = new Foo;
$y = ++$test;
?>
--EXPECTF--
Fatal error: Uncaught TypeError: Cannot increment Foo in %s:%d
Stack trace:
#0 {main}
thrown in %s on line %d

8
Zend/zend_vm_def.h
View File

@@ -1501,6 +1501,10 @@ ZEND_VM_HELPER(zend_pre_inc_helper, VAR|CV, ANY)
}
increment_function(var_ptr);
if (UNEXPECTED(EG(exception))) {
/* Smart branch expects result to be set with exceptions */
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_NULL(EX_VAR(opline->result.var));
}
HANDLE_EXCEPTION();
}
} while (0);
@@ -1556,6 +1560,10 @@ ZEND_VM_HELPER(zend_pre_dec_helper, VAR|CV, ANY)
}
decrement_function(var_ptr);
if (UNEXPECTED(EG(exception))) {
/* Smart branch expects result to be set with exceptions */
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_NULL(EX_VAR(opline->result.var));
}
HANDLE_EXCEPTION();
}
} while (0);

16
Zend/zend_vm_execute.h generated
View File

@@ -21625,6 +21625,10 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_inc_help
}
increment_function(var_ptr);
if (UNEXPECTED(EG(exception))) {
/* Smart branch expects result to be set with exceptions */
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_NULL(EX_VAR(opline->result.var));
}
HANDLE_EXCEPTION();
}
} while (0);
@@ -21698,6 +21702,10 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_dec_help
}
decrement_function(var_ptr);
if (UNEXPECTED(EG(exception))) {
/* Smart branch expects result to be set with exceptions */
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_NULL(EX_VAR(opline->result.var));
}
HANDLE_EXCEPTION();
}
} while (0);
@@ -39000,6 +39008,10 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_inc_help
}
increment_function(var_ptr);
if (UNEXPECTED(EG(exception))) {
/* Smart branch expects result to be set with exceptions */
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_NULL(EX_VAR(opline->result.var));
}
HANDLE_EXCEPTION();
}
} while (0);
@@ -39072,6 +39084,10 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_dec_help
}
decrement_function(var_ptr);
if (UNEXPECTED(EG(exception))) {
/* Smart branch expects result to be set with exceptions */
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
ZVAL_NULL(EX_VAR(opline->result.var));
}
HANDLE_EXCEPTION();
}
} while (0);