archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3' into PHP-8.4

Browse source 
* PHP-8.3:
  Use-after-free in extract() with EXTR_REFS
This commit is contained in:
Ilija Tovilo 2025-04-01 16:34:33 +02:00
commit 3ffb310fbd
No known key found for this signature in database
GPG key ID: 5050C66BFCD1015A
3 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -6,6 +6,7 @@ PHP NEWS
. Fixed bug GH-17711 and GH-18022 (Infinite recursion on deprecated attribute . Fixed bug GH-17711 and GH-18022 (Infinite recursion on deprecated attribute
evaluation). (ilutov) evaluation). (ilutov)
. Fixed bug GH-18038 (Lazy proxy calls magic methods twice). (Arnaud) . Fixed bug GH-18038 (Lazy proxy calls magic methods twice). (Arnaud)
. Fixed bug GH-18209 (Use-after-free in extract() with EXTR_REFS). (ilutov)
- GD: - GD:
. Fixed imagecrop() overflow with rect argument with x/width y/heigh usage . Fixed imagecrop() overflow with rect argument with x/width y/heigh usage

4
ext/standard/array.c
View file

@ -1972,8 +1972,10 @@ static zend_long php_extract_ref_overwrite(zend_array *arr, zend_array *symbol_t
} else { } else {
ZVAL_MAKE_REF_EX(entry, 2); ZVAL_MAKE_REF_EX(entry, 2);
} }
zval_ptr_dtor(orig_var); zval garbage;
ZVAL_COPY_VALUE(&garbage, orig_var);
ZVAL_REF(orig_var, Z_REF_P(entry)); ZVAL_REF(orig_var, Z_REF_P(entry));
zval_ptr_dtor(&garbage);
} else { } else {
if (Z_ISREF_P(entry)) { if (Z_ISREF_P(entry)) {
Z_ADDREF_P(entry); Z_ADDREF_P(entry);

23
ext/standard/tests/gh18209.phpt Normal file
View file

@ -0,0 +1,23 @@
--TEST--
GH-18209: Use-after-free in extract() with EXTR_REFS
--CREDITS--
Noam Rathaus (nrathaus)
--FILE--
<?php
class C {
public function __destruct() {
var_dump($GLOBALS['b']);
$GLOBALS['b'] = 43;
}
}
$b = new C;
$array = ['b' => 42];
extract($array, EXTR_REFS);
var_dump($b);
?>
--EXPECT--
int(42)
int(43)