1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00

Fix lazy proxy bailing __clone assertion

When __clone of the underlying object fails with a bailout, ZEND_ASSERT(res ==
SUCCESS) in zend_lazy_object_del_info() will fail because the info has not been
registered yet.

Only copy OBJ_EXTRA_FLAGS once the info has been successfully registered.

Fixes GH-20905
Closes GH-20975
This commit is contained in:
Ilija Tovilo
2026-01-19 15:47:03 +01:00
parent ee5fc4a030
commit f38f74521b
3 changed files with 24 additions and 2 deletions

1
NEWS
View File

@@ -14,6 +14,7 @@ PHP NEWS
backing value). (ilutov)
. Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may
uaf). (ilutov)
. Fixed bug GH-20905 (Lazy proxy bailing __clone assertion). (ilutov)
- Date:
. Update timelib to 2022.16. (Derick)

View File

@@ -0,0 +1,22 @@
--TEST--
GH-20905: Lazy proxy bailing __clone assertion
--FILE--
<?php
function test() {
function f() {}
}
class A {
public $_;
public function __clone() {
test();
}
}
test();
clone (new ReflectionClass(A::class))->newLazyProxy(fn() => new A);
?>
--EXPECTF--
Fatal error: Cannot redeclare function f() (previously declared in %s:%d) in %s on line %d

View File

@@ -744,12 +744,11 @@ zend_object *zend_lazy_object_clone(zend_object *old_obj)
}
}
OBJ_EXTRA_FLAGS(new_proxy) = OBJ_EXTRA_FLAGS(old_obj);
zend_lazy_object_info *new_info = emalloc(sizeof(*info));
*new_info = *info;
new_info->u.instance = zend_objects_clone_obj(info->u.instance);
OBJ_EXTRA_FLAGS(new_proxy) = OBJ_EXTRA_FLAGS(old_obj);
zend_lazy_object_set_info(new_proxy, new_info);
return new_proxy;