php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix zend_jit_undefined_long_key overwriting dim when dim == result
This commit is contained in:
Ilija Tovilo
2023-12-11 15:07:44 +01:00
parent 1bf55959eb 623da03845
commit e83a5683f9
3 changed files with 33 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -14,6 +14,10 @@ PHP NEWS
. Fixed bug GH-12870 (Creating an xmlns attribute results in a DOMException).
(nielsdos)
- Opcache:
. Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM
with NULL when DIM is the same var as result). (ilutov)
07 Dec 2023, PHP 8.3.1RC1
- Core:

4
ext/opcache/jit/zend_jit_vm_helpers.c
View File

@@ -205,7 +205,6 @@ void ZEND_FASTCALL zend_jit_undefined_long_key(EXECUTE_DATA_D)
zval *result = EX_VAR(opline->result.var);
zval *dim;
ZVAL_NULL(result);
if (opline->op2_type == IS_CONST) {
dim = RT_CONSTANT(opline, opline->op2);
} else {
@@ -213,6 +212,7 @@ void ZEND_FASTCALL zend_jit_undefined_long_key(EXECUTE_DATA_D)
}
ZEND_ASSERT(Z_TYPE_P(dim) == IS_LONG);
zend_error(E_WARNING, "Undefined array key " ZEND_LONG_FMT, Z_LVAL_P(dim));
ZVAL_NULL(result);
}
void ZEND_FASTCALL zend_jit_undefined_string_key(EXECUTE_DATA_D)
@@ -222,7 +222,6 @@ void ZEND_FASTCALL zend_jit_undefined_string_key(EXECUTE_DATA_D)
zval *dim;
zend_ulong lval;
ZVAL_NULL(result);
if (opline->op2_type == IS_CONST) {
dim = RT_CONSTANT(opline, opline->op2);
} else {
@@ -234,6 +233,7 @@ void ZEND_FASTCALL zend_jit_undefined_string_key(EXECUTE_DATA_D)
} else {
zend_error(E_WARNING, "Undefined array key \"%s\"", Z_STRVAL_P(dim));
}
ZVAL_NULL(result);
}
ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_jit_profile_helper(ZEND_OPCODE_HANDLER_ARGS)

27
ext/opcache/tests/jit/oss-fuzz-64727.phpt Normal file
View File

@@ -0,0 +1,27 @@
--TEST--
oss-fuzz #64727
--INI--
opcache.enable_cli=1
opcache.jit_buffer_size=64M
opcache.jit=function
--EXTENSIONS--
opcache
--FILE--
<?php
function test(){
$a = null;
$b = null;
for($i = 0; $i < 2; $i++){
$a = $a + $b;
var_dump($a);
$a = @[3][$a];
var_dump($a);
}
}
test();
?>
--EXPECT--
int(0)
int(3)
int(3)
NULL