archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.1' into PHP-8.2

Browse source 
* PHP-8.1:
  Fix incorrect CG(memoize_mode) state after bailout in ??=
This commit is contained in:
Ilija Tovilo 2023-04-20 19:46:05 +02:00
commit 439919c91d
No known key found for this signature in database
GPG key ID: A4F5D403F118200A
5 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -11,6 +11,8 @@ PHP NEWS
. Fixed bug GH-10737 (PHP 8.1.16 segfaults on line 597 of . Fixed bug GH-10737 (PHP 8.1.16 segfaults on line 597 of
sapi/apache2handler/sapi_apache2.c). (nielsdos, ElliotNB) sapi/apache2handler/sapi_apache2.c). (nielsdos, ElliotNB)
. Fixed bug GH-11028 (Heap Buffer Overflow in zval_undefined_cv.). (nielsdos) . Fixed bug GH-11028 (Heap Buffer Overflow in zval_undefined_cv.). (nielsdos)
. Fixed bug GH-11108 (Incorrect CG(memoize_mode) state after bailout in ??=).
(ilutov)
- Date: - Date:
. Fixed bug where the diff() method would not return the right result around . Fixed bug where the diff() method would not return the right result around

11
Zend/tests/gh11108.phpt Normal file
View file

@ -0,0 +1,11 @@
--TEST--
GH-11108: Incorrect CG(memoize_mode) state after bailout in ??=
--FILE--
<?php
register_shutdown_function(function() {
include __DIR__ . '/gh11108_shutdown.inc';
});
include __DIR__ . '/gh11108_test.inc';
?>
--EXPECTF--
Fatal error: Cannot use [] for reading in %s on line %d

5
Zend/tests/gh11108_shutdown.inc Normal file
View file

@ -0,0 +1,5 @@
<?php
function test() {
throw new Exception();
}

3
Zend/tests/gh11108_test.inc Normal file
View file

@ -0,0 +1,3 @@
<?php
$messageList[] ??= true;

1
Zend/zend.c
View file

@ -1172,6 +1172,7 @@ ZEND_API ZEND_COLD ZEND_NORETURN void _zend_bailout(const char *filename, uint32
CG(unclean_shutdown) = 1; CG(unclean_shutdown) = 1;
CG(active_class_entry) = NULL; CG(active_class_entry) = NULL;
CG(in_compilation) = 0; CG(in_compilation) = 0;
CG(memoize_mode) = 0;
EG(current_execute_data) = NULL; EG(current_execute_data) = NULL;
LONGJMP(*EG(bailout), FAILURE); LONGJMP(*EG(bailout), FAILURE);
} }