1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Files
archived-php-src/Zend/tests/gh14969.phpt
Ilija Tovilo 8c312ba74b Fix use-after-free in property coercion with __toString()
This was only partially fixed in PHP-8.3. Backports and fixes the case for both
initialized and uninitialized property writes.

Fixes GH-14969
Closes GH-14971
2024-07-16 12:40:14 +02:00

48 lines
661 B
PHP

--TEST--
GH-14969: Crash on coercion with throwing __toString()
--FILE--
<?php
class C {
public function __toString() {
global $c;
$c = [];
throw new Exception(__METHOD__);
}
}
class D {
public string $prop;
}
$c = new C();
$d = new D();
try {
$d->prop = $c;
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
var_dump($d);
$c = new C();
$d->prop = 'foo';
try {
$d->prop = $c;
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
var_dump($d);
?>
--EXPECTF--
C::__toString
object(D)#%d (0) {
["prop"]=>
uninitialized(string)
}
C::__toString
object(D)#2 (1) {
["prop"]=>
string(3) "foo"
}