php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Check for NULL GC type in objects_store_del

Browse Source 
This might happen if OBJ_RELEASE is used on an object that was already
released by GC. Specific cases of this issue were previously fixed in
ffaee27478 and
72104d2b6e, however the issue still
affects 3rd-party extensions using OBJ_RELEASE.

The whole GC type NULL + OBJ_IS_VALID + IS_FREE_CALLED system seems
overly complicated and can probably be simplified in 7.4.
This commit is contained in:
Nikita Popov
2019-03-01 14:32:11 +01:00
parent d63a7aa6cf
commit 4dc0662eca
2 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Zend/zend_generators.c
View File

@@ -123,8 +123,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
/* always free the CV's, in the symtable are only not-free'd IS_INDIRECT's */
zend_free_compiled_variables(execute_data);
if ((EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) &&
EXPECTED(GC_TYPE(Z_OBJ(execute_data->This)) == IS_OBJECT)) {
if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
OBJ_RELEASE(Z_OBJ(execute_data->This));
}
@@ -144,8 +143,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
}
/* Free closure object */
if ((EX_CALL_INFO() & ZEND_CALL_CLOSURE) &&
EXPECTED(GC_TYPE(ZEND_CLOSURE_OBJECT(EX(func))) == IS_OBJECT)) {
if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {
OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
}

13
Zend/zend_objects_API.c
View File

@@ -152,14 +152,17 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_put(zend_object *object)
ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object *object) /* {{{ */
{
ZEND_ASSERT(GC_REFCOUNT(object) == 0);
/* GC might have released this object already. */
if (UNEXPECTED(GC_TYPE(object) == IS_NULL)) {
return;
}
/* Make sure we hold a reference count during the destructor call
otherwise, when the destructor ends the storage might be freed
when the refcount reaches 0 a second time
*/
ZEND_ASSERT(EG(objects_store).object_buckets != NULL);
ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[object->handle]));
ZEND_ASSERT(GC_REFCOUNT(object) == 0);
if (!(OBJ_FLAGS(object) & IS_OBJ_DESTRUCTOR_CALLED)) {
GC_ADD_FLAGS(object, IS_OBJ_DESTRUCTOR_CALLED);
@@ -176,6 +179,8 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object *object) /* {{{ *
uint32_t handle = object->handle;
void *ptr;
ZEND_ASSERT(EG(objects_store).object_buckets != NULL);
ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[object->handle]));
EG(objects_store).object_buckets[handle] = SET_OBJ_INVALID(object);
if (!(OBJ_FLAGS(object) & IS_OBJ_FREE_CALLED)) {
GC_ADD_FLAGS(object, IS_OBJ_FREE_CALLED);