php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-14643 ext/standard: segfault on user shutdown function release. (#14656)

Browse Source
This commit is contained in:
David CARLIER
2024-06-25 21:13:15 +01:00
committed by GitHub
parent 4f450b6264
commit bc585cd87a
2 changed files with 30 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
Zend/zend_hash.h
View File

@@ -851,15 +851,16 @@ static zend_always_inline void *zend_hash_index_update_mem(HashTable *ht, zend_u
static zend_always_inline void *zend_hash_next_index_insert_mem(HashTable *ht, void *pData, size_t size)
{
zval tmp, *zv;
zval tmp;
ZVAL_PTR(&tmp, NULL);
if ((zv = zend_hash_next_index_insert(ht, &tmp))) {
Z_PTR_P(zv) = pemalloc(size, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
memcpy(Z_PTR_P(zv), pData, size);
return Z_PTR_P(zv);
void *p = pemalloc(size, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
memcpy(p, pData, size);
ZVAL_PTR(&tmp, p);
if (!zend_hash_next_index_insert(ht, &tmp)) {
pefree(p, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
return NULL;
}
return NULL;
return p;
}
static zend_always_inline void *zend_hash_find_ptr(const HashTable *ht, zend_string *key)

22
ext/standard/tests/gh14643_longname.phpt Normal file
View File

@@ -0,0 +1,22 @@
--TEST--
GH-14643: Segfault on empty user function.
--FILE--
<?php
class Logger {
public function __construct() {
register_shutdown_function(function () {
$this->flush();
register_shutdown_function([$this, 'flush'], true);
});
}
public function flush($final = false) {
}
}
while (true) {
$a = new Logger();
}
?>
--EXPECTF--
Fatal error: Allowed memory size of %d bytes exhausted %s
Fatal error: Allowed memory size of %d bytes exhausted %s