php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2'

Browse Source 
* PHP-8.2:
  Fix access on NULL pointer in array_merge_recursive()
This commit is contained in:
Ilija Tovilo
2023-05-24 13:37:59 +02:00
parent 2eee46e989 4676d9bc43
commit ded8b7f5bd
4 changed files with 38 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
Zend/tests/array_merge_recursive_next_key_overflow.phpt Normal file
View File

@@ -0,0 +1,25 @@
--TEST--
Access on NULL pointer in array_merge_recursive()
--FILE--
<?php
try {
array_merge_recursive(
['' => [PHP_INT_MAX => null]],
['' => [null]],
);
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
try {
array_merge_recursive(
['foo' => [PHP_INT_MAX => null]],
['foo' => str_repeat('a', 2)],
);
} catch (Throwable $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
Cannot add element to the array as the next element is already occupied
Cannot add element to the array as the next element is already occupied

2
Zend/zend_execute.c
View File

@@ -2288,7 +2288,7 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_scalar_as_array(v
zend_throw_error(NULL, "Cannot use a scalar value as an array");
}
static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
ZEND_API zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
{
zend_throw_error(NULL, "Cannot add element to the array as the next element is already occupied");
}

2
Zend/zend_execute.h
View File

@@ -88,6 +88,8 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_invalid_class_constant_type_error(uin
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_object_released_while_assigning_to_property_error(const zend_property_info *info);
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void);
ZEND_API bool zend_verify_scalar_type_hint(uint32_t type_mask, zval *arg, bool strict, bool is_internal_arg);
ZEND_API ZEND_COLD void zend_verify_arg_error(
const zend_function *zf, const zend_arg_info *arg_info, uint32_t arg_num, zval *value);

11
ext/standard/array.c
View File

@@ -3730,7 +3730,12 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
}
} else {
Z_TRY_ADDREF_P(src_zval);
zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval);
zval *zv = zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval);
if (EXPECTED(!zv)) {
Z_TRY_DELREF_P(src_zval);
zend_cannot_add_element();
return 0;
}
}
zval_ptr_dtor(&tmp);
} else {
@@ -3739,6 +3744,10 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
}
} else {
zval *zv = zend_hash_next_index_insert(dest, src_entry);
if (UNEXPECTED(!zv)) {
zend_cannot_add_element();
return 0;
}
zval_add_ref(zv);
}
} ZEND_HASH_FOREACH_END();