php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Cleanup SSA(s) in case of fatal error during tracing JIT

Browse Source 
This fixes segfault becuse of UAF in ext/standard/tests/gh14643_longname.phpt
This commit is contained in:
Dmitry Stogov
2025-09-02 10:04:40 +03:00
parent 93740d0a82
commit d59ae9345c
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
ext/opcache/jit/zend_jit_trace.c
View File

@@ -4064,6 +4064,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
zend_jit_trace_rec *p;
zend_jit_op_array_trace_extension *jit_extension;
int num_op_arrays = 0;
bool do_bailout = 0;
zend_jit_trace_info *t;
const zend_op_array *op_arrays[ZEND_JIT_TRACE_MAX_FUNCS];
uint8_t smart_branch_opcode;
@@ -4094,6 +4095,8 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
checkpoint = zend_arena_checkpoint(CG(arena));
zend_try {
ssa = zend_jit_trace_build_tssa(trace_buffer, parent_trace, exit_num, script, op_arrays, &num_op_arrays);
if (!ssa) {
@@ -7286,6 +7289,10 @@ jit_failure:
zend_string_release(name);
}
} zend_catch {
do_bailout = 1;
} zend_end_try();
jit_cleanup:
/* Clean up used op_arrays */
while (num_op_arrays > 0) {
@@ -7306,6 +7313,10 @@ jit_cleanup:
JIT_G(current_frame) = NULL;
JIT_G(current_trace) = NULL;
if (do_bailout) {
zend_bailout();
}
return handler;
}