php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 08:12:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3'

Browse Source 
* PHP-8.3:
  Fix zend_jit_undefined_long_key overwriting dim when dim == result
This commit is contained in:
Ilija Tovilo
2023-12-11 15:07:52 +01:00
parent a8eecec9b6 e83a5683f9
commit 185627f0c6
2 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ext/opcache/jit/zend_jit_vm_helpers.c
View File

@@ -200,7 +200,6 @@ void ZEND_FASTCALL zend_jit_undefined_long_key(EXECUTE_DATA_D)
zval *result = EX_VAR(opline->result.var);
zval *dim;
ZVAL_NULL(result);
if (opline->op2_type == IS_CONST) {
dim = RT_CONSTANT(opline, opline->op2);
} else {
@@ -208,6 +207,7 @@ void ZEND_FASTCALL zend_jit_undefined_long_key(EXECUTE_DATA_D)
}
ZEND_ASSERT(Z_TYPE_P(dim) == IS_LONG);
zend_error(E_WARNING, "Undefined array key " ZEND_LONG_FMT, Z_LVAL_P(dim));
ZVAL_NULL(result);
}
void ZEND_FASTCALL zend_jit_undefined_string_key(EXECUTE_DATA_D)
@@ -217,7 +217,6 @@ void ZEND_FASTCALL zend_jit_undefined_string_key(EXECUTE_DATA_D)
zval *dim;
zend_ulong lval;
ZVAL_NULL(result);
if (opline->op2_type == IS_CONST) {
dim = RT_CONSTANT(opline, opline->op2);
} else {
@@ -229,6 +228,7 @@ void ZEND_FASTCALL zend_jit_undefined_string_key(EXECUTE_DATA_D)
} else {
zend_error(E_WARNING, "Undefined array key \"%s\"", Z_STRVAL_P(dim));
}
ZVAL_NULL(result);
}
ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_jit_profile_helper(ZEND_OPCODE_HANDLER_ARGS)

27
ext/opcache/tests/jit/oss-fuzz-64727.phpt Normal file
View File

@@ -0,0 +1,27 @@
--TEST--
oss-fuzz #64727
--INI--
opcache.enable_cli=1
opcache.jit_buffer_size=64M
opcache.jit=function
--EXTENSIONS--
opcache
--FILE--
<?php
function test(){
$a = null;
$b = null;
for($i = 0; $i < 2; $i++){
$a = $a + $b;
var_dump($a);
$a = @[3][$a];
var_dump($a);
}
}
test();
?>
--EXPECT--
int(0)
int(3)
int(3)
NULL