php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash when exception is thrown during ROPE_END

Browse Source 
The CHECK_EXCEPTION() was done at a point where the old opline is
still used, thus redirecting the write to the result var into
EX(call) instead.

Handling the exception in-place to avoid leaking result.
This commit is contained in:
Nikita Popov
2015-07-06 20:12:07 +02:00
parent f3498783df
commit 89ce8d28de
3 changed files with 41 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
Zend/tests/exception_in_rope_end.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
Exception during rope finalization
--FILE--
<?php
set_error_handler(function() { throw new Exception; });
try {
$b = "foo";
$str = "y$b$a";
} catch (Exception $e) {
echo "Exception\n";
}
?>
--EXPECT--
Exception

7
Zend/zend_vm_def.h
View File

@@ -2859,7 +2859,12 @@ ZEND_VM_HANDLER(56, ZEND_ROPE_END, TMP, CONST|TMPVAR|CV)
}
rope[opline->extended_value] = _zval_get_string_func(var);
FREE_OP2();
CHECK_EXCEPTION();
if (UNEXPECTED(EG(exception))) {
for (i = 0; i <= opline->extended_value; i++) {
zend_string_release(rope[i]);
}
HANDLE_EXCEPTION();
}
}
}
for (i = 0; i <= opline->extended_value; i++) {

21
Zend/zend_vm_execute.h
View File

@@ -12999,7 +12999,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ROPE_END_SPEC_TMP_CONST_HANDLE
}
rope[opline->extended_value] = _zval_get_string_func(var);
CHECK_EXCEPTION();
if (UNEXPECTED(EG(exception))) {
for (i = 0; i <= opline->extended_value; i++) {
zend_string_release(rope[i]);
}
HANDLE_EXCEPTION();
}
}
}
for (i = 0; i <= opline->extended_value; i++) {
@@ -14283,7 +14288,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ROPE_END_SPEC_TMP_CV_HANDLER(Z
}
rope[opline->extended_value] = _zval_get_string_func(var);
CHECK_EXCEPTION();
if (UNEXPECTED(EG(exception))) {
for (i = 0; i <= opline->extended_value; i++) {
zend_string_release(rope[i]);
}
HANDLE_EXCEPTION();
}
}
}
for (i = 0; i <= opline->extended_value; i++) {
@@ -14796,7 +14806,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ROPE_END_SPEC_TMP_TMPVAR_HANDL
}
rope[opline->extended_value] = _zval_get_string_func(var);
zval_ptr_dtor_nogc(free_op2);
CHECK_EXCEPTION();
if (UNEXPECTED(EG(exception))) {
for (i = 0; i <= opline->extended_value; i++) {
zend_string_release(rope[i]);
}
HANDLE_EXCEPTION();
}
}
}
for (i = 0; i <= opline->extended_value; i++) {