php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.5'

Browse Source 
* PHP-8.5:
  Fix GH-21454: Missing write lock validation in SplHeap
This commit is contained in:
ndossche
2026-03-17 08:47:51 +01:00
parent 8cf917990c c9a6743b59
commit a16ace8ee7
2 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ext/spl/spl_heap.c
View File

@@ -938,7 +938,7 @@ static void spl_heap_it_move_forward(zend_object_iterator *iter) /* {{{ */
{
spl_heap_object *object = Z_SPLHEAP_P(&iter->data);
if (UNEXPECTED(spl_heap_consistency_validations(object, false) != SUCCESS)) {
if (UNEXPECTED(spl_heap_consistency_validations(object, true) != SUCCESS)) {
return;
}
@@ -965,6 +965,10 @@ PHP_METHOD(SplHeap, next)
ZEND_PARSE_PARAMETERS_NONE();
if (UNEXPECTED(spl_heap_consistency_validations(intern, true) != SUCCESS)) {
RETURN_THROWS();
}
spl_ptr_heap_delete_top(intern->heap, NULL, ZEND_THIS);
}
/* }}} */

34
ext/spl/tests/heap_next_write_lock.phpt Normal file
View File

@@ -0,0 +1,34 @@
--TEST--
SplHeap::next() write lock
--CREDITS--
cnitlrt
--FILE--
<?php
class EvilPQ extends SplPriorityQueue {
private bool $did = false;
public function compare(mixed $p1, mixed $p2): int {
if (!$this->did) {
$this->did = true;
// Re-entrant write during internal heap insertion comparison.
if (!$this->isEmpty()) {
$this->next(); // no write-lock validation
}
}
return parent::compare($p1, $p2);
}
}
$q = new EvilPQ();
try {
for ($i = 0; $i < 200; $i++) {
$q->insert("d$i", 100 - $i);
}
} catch (RuntimeException $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}
?>
--EXPECT--
RuntimeException: Heap cannot be changed when it is already being modified.