php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix duplicate dynamic properties in hooked object iterator properties table

Browse Source 
Ouch, Z_TRY_ADDREF_P() uses pz twice... Also make sure we actually reserve
enough Buckets for all dynamic properties.

Fixes OSS-Fuzz #382922236
Closes GH-17085
This commit is contained in:
Ilija Tovilo
2024-12-08 20:02:26 +01:00
parent 7b5141b85d
commit 84917300b2
3 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -7,6 +7,10 @@ PHP NEWS
. Fixed bug GH-17061 (Now Number::round() does not remove trailing zeros).
(Saki Takamachi)
- Core:
. Fixed bug OSS-Fuzz #382922236 (Duplicate dynamic properties in hooked object
iterator properties table). (ilutov)
- DBA:
. Skip test if inifile is disabled. (orlitzky)

20
Zend/tests/property_hooks/oss-fuzz-382922236.phpt Normal file
View File

@@ -0,0 +1,20 @@
--TEST--
OSS-Fuzz #382922236: Duplicate dynamic properties in hooked object iterator properties table
--FILE--
<?php
#[AllowDynamicProperties]
class C {
public $a {
get => 42;
}
}
$obj = new C();
$b = &$obj->b;
unset($b);
echo json_encode($obj);
?>
--EXPECT--
{"a":42,"b":null}

7
Zend/zend_property_hooks.c
View File

@@ -44,7 +44,9 @@ static uint32_t zho_num_backed_props(zend_object *zobj)
static zend_array *zho_build_properties_ex(zend_object *zobj, bool check_access, bool force_ptr, bool include_dynamic_props)
{
zend_class_entry *ce = zobj->ce;
zend_array *properties = zend_new_array(ce->default_properties_count);
zend_array *properties = zend_new_array(include_dynamic_props && zobj->properties
? zend_hash_num_elements(zobj->properties)
: ce->default_properties_count);
zend_hash_real_init_mixed(properties);
/* Build list of parents */
@@ -105,7 +107,8 @@ skip_property:
zend_string *prop_name;
zval *prop_value;
ZEND_HASH_FOREACH_STR_KEY_VAL_FROM(zobj->properties, prop_name, prop_value, zho_num_backed_props(zobj)) {
Z_TRY_ADDREF_P(_zend_hash_append(properties, prop_name, prop_value));
zval *tmp = _zend_hash_append(properties, prop_name, prop_value);
Z_TRY_ADDREF_P(tmp);
} ZEND_HASH_FOREACH_END();
}