php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix OSS-Fuzz #371445205: Heap-use-after-free in attr_free
This commit is contained in:
Niels Dossche
2024-10-11 09:07:25 +02:00
parent 6e172f0ac1 e0b1b693e3
commit 543c168314
2 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
Zend/tests/attributes/ossfuzz371445205.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
OSS-Fuzz #371445205 (Heap-use-after-free in attr_free)
--FILE--
<?php
#[Attribute]
class MyAttrib{}
#[MyAttrib(notinterned:'')]
class Test1{}
$attr=(new ReflectionClass(Test1::class))->getAttributes()[0];
try {
$attr->newInstance();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
Unknown named parameter $notinterned

1
Zend/zend_API.c
View File

@@ -1879,7 +1879,6 @@ ZEND_API zend_result object_init_with_constructor(zval *arg, zend_class_entry *c
zend_hash_get_current_key(named_params, &arg_name, /* num_index */ NULL);
ZEND_ASSERT(arg_name != NULL);
zend_throw_error(NULL, "Unknown named parameter $%s", ZSTR_VAL(arg_name));
zend_string_release(arg_name);
/* Do not call destructor, free object, and set arg to IS_UNDEF */
zend_object_store_ctor_failed(obj);
zval_ptr_dtor(arg);