php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-16604: Memory leaks in SPL constructors

Browse Source 
Closes GH-16673.
This commit is contained in:
Niels Dossche
2024-11-01 19:53:48 +01:00
parent ec68d3c608
commit 886a5287ca
5 changed files with 61 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -113,6 +113,7 @@ PHP NEWS
. Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()). (nielsdos)
. Fixed bug GH-14687 (segfault on SplObjectIterator instance).
(David Carlier)
. Fixed bug GH-16604 (Memory leaks in SPL constructors). (nielsdos)
- Standard:
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with

8
ext/spl/spl_directory.c
View File

@@ -2053,6 +2053,12 @@ PHP_METHOD(SplFileObject, __construct)
RETURN_THROWS();
}
/* Prevent reinitialization of Object */
if (UNEXPECTED(intern->u.file.stream)) {
zend_throw_error(NULL, "Cannot call constructor twice");
RETURN_THROWS();
}
intern->u.file.open_mode = zend_string_copy(open_mode);
/* file_name and zcontext are copied by spl_filesystem_file_open() */
intern->file_name = file_name;
@@ -2096,7 +2102,7 @@ PHP_METHOD(SplTempFileObject, __construct)
}
/* Prevent reinitialization of Object */
if (intern->u.file.stream) {
if (UNEXPECTED(intern->u.file.stream)) {
zend_throw_error(NULL, "Cannot call constructor twice");
RETURN_THROWS();
}

27
ext/spl/spl_iterators.c
View File

@@ -538,6 +538,20 @@ static int spl_get_iterator_from_aggregate(zval *retval, zend_class_entry *ce, z
return SUCCESS;
}
static void spl_RecursiveIteratorIterator_free_iterators(spl_recursive_it_object *object)
{
if (object->iterators) {
while (object->level >= 0) {
zend_object_iterator *sub_iter = object->iterators[object->level].iterator;
zend_iterator_dtor(sub_iter);
zval_ptr_dtor(&object->iterators[object->level].zobject);
object->level--;
}
efree(object->iterators);
object->iterators = NULL;
}
}
static void spl_recursive_it_it_construct(INTERNAL_FUNCTION_PARAMETERS, zend_class_entry *ce_base, zend_class_entry *ce_inner, recursive_it_it_type rit_type)
{
zval *object = ZEND_THIS;
@@ -604,6 +618,7 @@ static void spl_recursive_it_it_construct(INTERNAL_FUNCTION_PARAMETERS, zend_cla
}
intern = Z_SPLRECURSIVE_IT_P(object);
spl_RecursiveIteratorIterator_free_iterators(intern);
intern->iterators = emalloc(sizeof(spl_sub_iterator));
intern->level = 0;
intern->mode = mode;
@@ -650,6 +665,7 @@ static void spl_recursive_it_it_construct(INTERNAL_FUNCTION_PARAMETERS, zend_cla
intern->iterators[0].getchildren = NULL;
if (EG(exception)) {
// TODO: use spl_RecursiveIteratorIterator_free_iterators
zend_object_iterator *sub_iter;
while (intern->level >= 0) {
@@ -958,16 +974,7 @@ static void spl_RecursiveIteratorIterator_free_storage(zend_object *_object)
{
spl_recursive_it_object *object = spl_recursive_it_from_obj(_object);
if (object->iterators) {
while (object->level >= 0) {
zend_object_iterator *sub_iter = object->iterators[object->level].iterator;
zend_iterator_dtor(sub_iter);
zval_ptr_dtor(&object->iterators[object->level].zobject);
object->level--;
}
efree(object->iterators);
object->iterators = NULL;
}
spl_RecursiveIteratorIterator_free_iterators(object);
zend_object_std_dtor(&object->std);
for (size_t i = 0; i < 6; i++) {

15
ext/spl/tests/gh16604_1.phpt Normal file
View File

@@ -0,0 +1,15 @@
--TEST--
GH-16604 (Memory leaks in SPL constructors) - recursive iterators
--FILE--
<?php
$traversable = new RecursiveArrayIterator( [] );
$obj = new RecursiveIteratorIterator( $traversable );
$obj->__construct( $traversable );
$obj = new RecursiveTreeIterator( $traversable );
$obj->__construct( $traversable );
?>
--EXPECT--

21
ext/spl/tests/gh16604_2.phpt Normal file
View File

@@ -0,0 +1,21 @@
--TEST--
GH-16604 (Memory leaks in SPL constructors) - SplFileObject
--FILE--
<?php
file_put_contents(__DIR__.'/gh16604_2.tmp', 'hello');
$obj = new SplFileObject(__DIR__.'/gh16604_2.tmp');
try {
$obj->__construct(__DIR__.'/gh16604_2.tmp');
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
?>
--CLEAN--
<?php
@unlink(__DIR__.'/gh16604_2.tmp');
?>
--EXPECT--
Cannot call constructor twice