php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix dumping function signature with dynamic class const lookup default argument

Browse Source 
Fixes OSS-Fuzz #465488618
Closes GH-20651
This commit is contained in:
Ilija Tovilo
2025-12-05 19:32:40 +01:00
parent 1f1147a666
commit 26c0cbd93c
3 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -2,6 +2,10 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.3.30
- Core:
. Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature
with dynamic class const lookup default argument). (ilutov)
- Bz2:
. Fixed bug GH-20620 (bzcompress overflow on large source size).
(David Carlier)

16
Zend/tests/oss-fuzz-465488618.phpt Normal file
View File

@@ -0,0 +1,16 @@
--TEST--
OSS-Fuzz #465488618: Dump function signature with dynamic class const lookup default argument
--FILE--
<?php
class A {
public function test(int $x) {}
}
class B extends A {
public function test(string $x = Foo::{C}) {}
}
?>
--EXPECTF--
Fatal error: Declaration of B::test(string $x = <expression>) must be compatible with A::test(int $x) in %s on line %d

4
Zend/zend_inheritance.c
View File

@@ -973,7 +973,9 @@ static ZEND_COLD zend_string *zend_get_function_declaration(
zend_ast *ast = Z_ASTVAL_P(zv);
if (ast->kind == ZEND_AST_CONSTANT) {
smart_str_append(&str, zend_ast_get_constant_name(ast));
} else if (ast->kind == ZEND_AST_CLASS_CONST) {
} else if (ast->kind == ZEND_AST_CLASS_CONST
&& ast->child[1]->kind == ZEND_AST_ZVAL
&& Z_TYPE_P(zend_ast_get_zval(ast->child[1])) == IS_STRING) {
smart_str_append(&str, zend_ast_get_str(ast->child[0]));
smart_str_appends(&str, "::");
smart_str_append(&str, zend_ast_get_str(ast->child[1]));