Niels Dossche b71c6b2c6c Fix #81992: SplFixedArray::setSize() causes use-after-free ...

Upon resizing, the elements are destroyed from lower index to higher
index. When an element refers to an object with a destructor, it can
refer to a lower (i.e. already destroyed) element, causing a uaf.
Set refcounted zvals to NULL after destroying them to avoid a uaf.

Closes GH-11959.

2023-08-14 21:32:22 +02:00

..

tests

Fix #81992: SplFixedArray::setSize() causes use-after-free

2023-08-14 21:32:22 +02:00

config.m4

Refactor SplFixedArray (#7168)

2021-06-18 15:22:52 +01:00

config.w32

Refactor SplFixedArray (#7168)

2021-06-18 15:22:52 +01:00

CREDITS

Change some permissions from 755 to 644

2018-08-28 23:26:49 +02:00

php_spl_arginfo.h

Add support for generating MAY_BE_ARRAY_OF_REF func info flag (#7416)

2021-08-30 13:50:34 +02:00

php_spl.c

Fix GH-10011 (Trampoline autoloader will get reregistered and cannot be unregistered)

2022-12-02 12:47:25 +00:00

php_spl.h

Use ZEND_TLS for spl (#7043)

2021-05-26 09:36:23 +02:00

php_spl.stub.php

Add support for generating MAY_BE_ARRAY_OF_REF func info flag (#7416)

2021-08-30 13:50:34 +02:00

spl_array_arginfo.h

Narrow ArrayIterator::key() return type

2021-07-15 11:03:50 +02:00

spl_array.c

Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)

2023-05-03 19:42:04 +02:00

spl_array.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_array.stub.php

Narrow ArrayIterator::key() return type

2021-07-15 11:03:50 +02:00

spl_directory_arginfo.h

Fix GH-9883 SplFileObject::__toString() reads next line

2022-11-22 12:21:14 +00:00

spl_directory.c

Fix GH-11338: SplFileInfo empty getBasename with more than one slash

2023-05-30 17:29:18 +02:00

spl_directory.h

Store SplFileObject open_mode as zend_string

2021-05-07 11:23:05 +02:00

spl_directory.stub.php

Fix GH-9883 SplFileObject::__toString() reads next line

2022-11-22 12:21:14 +00:00

spl_dllist_arginfo.h

Declare tentative return types for ext/spl - part 2

2021-07-14 15:19:51 +02:00

spl_dllist.c

fix [-Wstrict-prototypes] buid warnings

2021-11-24 14:55:11 +01:00

spl_dllist.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_dllist.stub.php

Declare tentative return types for ext/spl - part 2

2021-07-14 15:19:51 +02:00

spl_engine.h

Refactor SplFixedArray (#7168)

2021-06-18 15:22:52 +01:00

spl_exceptions_arginfo.h

Generate ext/spl class entries from stubs

2021-02-18 13:01:51 +01:00

spl_exceptions.c

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_exceptions.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_exceptions.stub.php

Generate ext/spl class entries from stubs

2021-02-18 13:01:51 +01:00

spl_fixedarray_arginfo.h

Declare tentative return types for ext/spl - part 2

2021-07-14 15:19:51 +02:00

spl_fixedarray.c

Fix #81992: SplFixedArray::setSize() causes use-after-free

2023-08-14 21:32:22 +02:00

spl_fixedarray.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_fixedarray.stub.php

Declare tentative return types for ext/spl - part 2

2021-07-14 15:19:51 +02:00

spl_functions.c

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_functions.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_heap_arginfo.h

Declare tentative return types for ext/spl - part 2

2021-07-14 15:19:51 +02:00

spl_heap.c

Add RETURN/RETVAL_COPY_DEREF() macros

2021-07-22 09:44:19 +02:00

spl_heap.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_heap.stub.php

Declare tentative return types for ext/spl - part 2

2021-07-14 15:19:51 +02:00

spl_iterators_arginfo.h

Migrate to PHP-Parser 4.12.0 and regenerate some arginfos

2021-07-22 09:40:16 +02:00

spl_iterators.c

Fix reference returned from CallbackFilterIterator::accept()

2023-04-20 10:18:18 +02:00

spl_iterators.h

Store cached string as zend_string

2021-06-09 10:15:36 +02:00

spl_iterators.stub.php

Actually, abstract methods don't have a body

2021-07-20 01:00:10 +02:00

spl_observer_arginfo.h

Remove bogus type of $object param in SplObjectStorage::offsetSet()

2021-12-28 18:01:26 +01:00

spl_observer.c

Merge branch 'PHP-8.0' into PHP-8.1

2021-11-04 10:38:08 +01:00

spl_observer.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

spl_observer.stub.php

Remove bogus type of $object param in SplObjectStorage::offsetSet()

2021-12-28 18:01:26 +01:00