archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix use-after-free in SplObjectStorage::setInfo()

Browse source 
Fixes GH-16479
Closes GH-16482
This commit is contained in:
Ilija Tovilo 2024-10-17 16:12:35 +02:00
parent 5ef3fe218c
commit 12c987fae2
No known key found for this signature in database
GPG key ID: 5050C66BFCD1015A
3 changed files with 29 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -70,6 +70,7 @@ PHP NEWS
. Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos) . Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos)
. Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()). . Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
(ilutov) (ilutov)
. Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov)
- Standard: - Standard:
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with . Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with

4
ext/spl/spl_observer.c
View file

@ -746,8 +746,10 @@ PHP_METHOD(SplObjectStorage, setInfo)
if ((element = zend_hash_get_current_data_ptr_ex(&intern->storage, &intern->pos)) == NULL) { if ((element = zend_hash_get_current_data_ptr_ex(&intern->storage, &intern->pos)) == NULL) {
RETURN_NULL(); RETURN_NULL();
} }
zval_ptr_dtor(&element->inf); zval garbage;
ZVAL_COPY_VALUE(&garbage, &element->inf);
ZVAL_COPY(&element->inf, inf); ZVAL_COPY(&element->inf, inf);
zval_ptr_dtor(&garbage);
} /* }}} */ } /* }}} */
/* {{{ Moves position forward */ /* {{{ Moves position forward */

25
ext/spl/tests/gh16479.phpt Normal file
View file

@ -0,0 +1,25 @@
--TEST--
GH-16479: Use-after-free in SplObjectStorage::setInfo()
--FILE--
<?php
class C {
function __destruct() {
global $store;
$store->removeAll($store);
}
}
$o = new stdClass;
$store = new SplObjectStorage;
$store[$o] = new C;
$store->setInfo(1);
var_dump($store);
?>
--EXPECT--
object(SplObjectStorage)#2 (1) {
["storage":"SplObjectStorage":private]=>
array(0) {
}
}