php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4' into PHP-8.5

Browse Source 
* PHP-8.4:
  Fix leaked parent property default value
This commit is contained in:
Ilija Tovilo
2026-01-13 13:09:23 +01:00
parent cc21f5e095 4bfaf549f6
commit c35e391b2d
3 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -12,6 +12,7 @@ PHP NEWS
. Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov) . Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov)
. Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov) . Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov)
. Fixed bug GH-GH-20914 (Internal enums can be cloned and compared). (Arnaud) . Fixed bug GH-GH-20914 (Internal enums can be cloned and compared). (Arnaud)
. Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov)
- MbString: - MbString:
. Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is . Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is

17
Zend/tests/oss-fuzz-474613951.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
OSS-Fuzz #474613951: Leaked parent property default value
--FILE--
<?php
class A {
public $prop = C { get => $this->prop; }
}
class B extends A {
public $prop { get => 42; }
}
?>
===DONE===
--EXPECT--
===DONE===

5
Zend/zend_inheritance.c
View File

@@ -1519,10 +1519,9 @@ static void do_inherit_property(zend_property_info *parent_info, zend_string *ke
} }
int parent_num = OBJ_PROP_TO_NUM(parent_info->offset); int parent_num = OBJ_PROP_TO_NUM(parent_info->offset);
/* Don't keep default properties in GC (they may be freed by opcache) */
zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
if (child_info->offset != ZEND_VIRTUAL_PROPERTY_OFFSET) { if (child_info->offset != ZEND_VIRTUAL_PROPERTY_OFFSET) {
/* Don't keep default properties in GC (they may be freed by opcache) */
zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
if (use_child_prop) { if (use_child_prop) {
ZVAL_UNDEF(&ce->default_properties_table[parent_num]); ZVAL_UNDEF(&ce->default_properties_table[parent_num]);
} else { } else {