php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix double-free of doc_comment when overriding static property via trait
This commit is contained in:
Ilija Tovilo
2023-10-19 15:23:26 +02:00
parent 80b4c73030 4f1f77c51b
commit 8347740c8c
4 changed files with 41 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -6,6 +6,8 @@ PHP NEWS
. Fixed double-free of non-interned enum case name. (ilutov)
. Fixed bug GH-12457 (Incorrect result of stripos with single character
needle). (SakiTakamachi)
. Fixed bug GH-12468 (Double-free of doc_comment when overriding static
property via trait). (ilutov)
- DOM:
. Fix registerNodeClass with abstract class crashing. (nielsdos)

18
Zend/tests/gh12468_1.phpt Normal file
View File

@@ -0,0 +1,18 @@
--TEST--
GH-12468: Double-free of doc_comment when overriding static property via trait
--FILE--
<?php
trait T {
/** some doc */
static protected $a = 0;
}
class A {
use T;
}
class B extends A {
use T;
}
?>
===DONE===
--EXPECT--
===DONE===

19
Zend/tests/gh12468_2.phpt Normal file
View File

@@ -0,0 +1,19 @@
--TEST--
GH-12468: Double-free of doc_comment when overriding static property via trait
--FILE--
<?php
trait T {
/** some doc */
static protected $a = 0;
}
class A {
/** some doc */
static protected $a = 0;
}
class B extends A {
use T;
}
?>
===DONE===
--EXPECT--
===DONE===

4
Zend/zend_API.c
View File

@@ -4332,7 +4332,7 @@ ZEND_API zend_property_info *zend_declare_typed_property(zend_class_entry *ce, z
(property_info_ptr->flags & ZEND_ACC_STATIC) != 0) {
property_info->offset = property_info_ptr->offset;
zval_ptr_dtor(&ce->default_static_members_table[property_info->offset]);
if (property_info_ptr->doc_comment) {
if (property_info_ptr->doc_comment && property_info_ptr->ce == ce) {
zend_string_release(property_info_ptr->doc_comment);
}
zend_hash_del(&ce->properties_info, name);
@@ -4353,7 +4353,7 @@ ZEND_API zend_property_info *zend_declare_typed_property(zend_class_entry *ce, z
(property_info_ptr->flags & ZEND_ACC_STATIC) == 0) {
property_info->offset = property_info_ptr->offset;
zval_ptr_dtor(&ce->default_properties_table[OBJ_PROP_TO_NUM(property_info->offset)]);
if (property_info_ptr->doc_comment) {
if (property_info_ptr->doc_comment && property_info_ptr->ce == ce) {
zend_string_release_ex(property_info_ptr->doc_comment, 1);
}
zend_hash_del(&ce->properties_info, name);