php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-08 00:22:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.0' into PHP-8.1

Browse Source 
* PHP-8.0:
  Fix leak with ASSIGN_OBJ on null
This commit is contained in:
Nikita Popov
2021-09-28 16:33:58 +02:00
parent f79bd08573 97b5eeeb6c
commit b5242fa19a
3 changed files with 43 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ext/opcache/jit/zend_jit_arm64.dasc
View File

@@ -12923,12 +12923,12 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
} else {
| EXT_CALL zend_jit_invalid_property_assign, REG0
}
may_throw = 1;
if (((opline+1)->op1_type & (IS_VAR|IS_TMP_VAR))
&& (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
may_throw = 1;
| b >8
} else {
| b ->exception_handler
| b >9
}
|.code
}
@@ -13296,7 +13296,7 @@ static int zend_jit_assign_obj(dasm_State **Dst,
&& (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
| b >7
} else {
| b ->exception_handler
| b >9
}
|.code
}

5
ext/opcache/jit/zend_jit_x86.dasc
View File

@@ -13667,12 +13667,13 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
} else {
| EXT_CALL zend_jit_invalid_property_assign, r0
}
may_throw = 1;
if (((opline+1)->op1_type & (IS_VAR|IS_TMP_VAR))
&& (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
may_throw = 1;
| jmp >8
} else {
| jmp ->exception_handler
| jmp >9
}
|.code
}
@@ -14081,7 +14082,7 @@ static int zend_jit_assign_obj(dasm_State **Dst,
&& (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
| jmp >7
} else {
| jmp ->exception_handler
| jmp >9
}
|.code
}

37
ext/opcache/tests/jit/assign_obj_on_null.phpt Normal file
View File

@@ -0,0 +1,37 @@
--TEST--
ASSIGN_OBJ on null reference returned from __get()
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.file_update_protection=0
opcache.jit_buffer_size=1M
--FILE--
<?php
class Test {
public $prop;
public function &__get($name) {
return $this->prop;
}
}
function test() {
$obj = new Test;
$obj->x->y = 1;
}
function test2() {
$obj = new Test;
$obj->x->y += 1;
}
try {
test();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
try {
test2();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
Attempt to assign property "y" on null
Attempt to assign property "y" on null