php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix missing deref in zend_fe_fetch_object_helper (GH-21116)

Browse Source 
Fixes OSS-Fuzz #481017027
Introduced in GH-20628
This commit is contained in:
Ilija Tovilo
2026-02-03 13:55:49 +01:00
committed by GitHub
parent d16e6f52a4
commit 4188c3ee2c
3 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
Zend/tests/oss-fuzz-481017027.phpt Normal file
View File

@@ -0,0 +1,23 @@
--TEST--
OSS-Fuzz #481017027: Missing zend_fe_fetch_object_helper deref
--FILE--
<?php
class C {
public $y;
}
function test($obj, $name) {
foreach ($obj as $$name) {
var_dump($$name);
}
}
$y = 42;
$obj = new C;
$obj->y = &$y;
test($obj, '');
?>
--EXPECT--
int(42)

4
Zend/zend_vm_def.h
View File

@@ -7183,6 +7183,10 @@ ZEND_VM_C_LABEL(fe_fetch_r_exit):
zval *variable_ptr = EX_VAR(opline->op2.var);
zend_assign_to_variable(variable_ptr, value, IS_CV, EX_USES_STRICT_TYPES());
} else {
if (UNEXPECTED(Z_ISREF_P(value))) {
value = Z_REFVAL_P(value);
value_type = Z_TYPE_INFO_P(value);
}
zval *res = EX_VAR(opline->op2.var);
zend_refcounted *gc = Z_COUNTED_P(value);

8
Zend/zend_vm_execute.h generated
View File

@@ -3106,6 +3106,10 @@ fe_fetch_r_exit:
zval *variable_ptr = EX_VAR(opline->op2.var);
zend_assign_to_variable(variable_ptr, value, IS_CV, EX_USES_STRICT_TYPES());
} else {
if (UNEXPECTED(Z_ISREF_P(value))) {
value = Z_REFVAL_P(value);
value_type = Z_TYPE_INFO_P(value);
}
zval *res = EX_VAR(opline->op2.var);
zend_refcounted *gc = Z_COUNTED_P(value);
@@ -55764,6 +55768,10 @@ fe_fetch_r_exit:
zval *variable_ptr = EX_VAR(opline->op2.var);
zend_assign_to_variable(variable_ptr, value, IS_CV, EX_USES_STRICT_TYPES());
} else {
if (UNEXPECTED(Z_ISREF_P(value))) {
value = Z_REFVAL_P(value);
value_type = Z_TYPE_INFO_P(value);
}
zval *res = EX_VAR(opline->op2.var);
zend_refcounted *gc = Z_COUNTED_P(value);