php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix uaf in SplFixedArray::unset()
This commit is contained in:
Ilija Tovilo
2024-10-17 18:26:01 +02:00
parent 9cb0f03808 c82cea0c34
commit 76138d6f0f
2 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ext/spl/spl_fixedarray.c
View File

@@ -459,8 +459,10 @@ static void spl_fixedarray_object_unset_dimension_helper(spl_fixedarray_object *
zend_throw_exception(spl_ce_OutOfBoundsException, "Index invalid or out of range", 0);
return;
} else {
zval_ptr_dtor(&(intern->array.elements[index]));
zval garbage;
ZVAL_COPY_VALUE(&garbage, &intern->array.elements[index]);
ZVAL_NULL(&intern->array.elements[index]);
zval_ptr_dtor(&garbage);
}
}

21
ext/spl/tests/gh16478.phpt Normal file
View File

@@ -0,0 +1,21 @@
--TEST--
GH-16478: Use-after-free in SplFixedArray::unset()
--FILE--
<?php
class C {
function __destruct() {
global $arr;
$arr->setSize(0);
}
}
$arr = new SplFixedArray(2);
$arr[0] = new C;
unset($arr[0]);
var_dump($arr);
?>
--EXPECT--
object(SplFixedArray)#1 (0) {
}