archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix incorrect CG(memoize_mode) state after bailout in ??=

Browse source 
Fixes GH-11108
Closes GH-11109
This commit is contained in:
Ilija Tovilo 2023-04-20 15:41:50 +02:00
parent 5855bdcd6c
commit 4c38a79f09
No known key found for this signature in database
GPG key ID: A4F5D403F118200A
5 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -11,6 +11,8 @@ PHP NEWS
. Fixed bug GH-10737 (PHP 8.1.16 segfaults on line 597 of . Fixed bug GH-10737 (PHP 8.1.16 segfaults on line 597 of
sapi/apache2handler/sapi_apache2.c). (nielsdos, ElliotNB) sapi/apache2handler/sapi_apache2.c). (nielsdos, ElliotNB)
. Fixed bug GH-11028 (Heap Buffer Overflow in zval_undefined_cv.). (nielsdos) . Fixed bug GH-11028 (Heap Buffer Overflow in zval_undefined_cv.). (nielsdos)
. Fixed bug GH-11108 (Incorrect CG(memoize_mode) state after bailout in ??=).
(ilutov)
- DOM: - DOM:
. Fixed bug #80602 (Segfault when using DOMChildNode::before()). . Fixed bug #80602 (Segfault when using DOMChildNode::before()).

11
Zend/tests/gh11108.phpt Normal file
View file

@ -0,0 +1,11 @@
--TEST--
GH-11108: Incorrect CG(memoize_mode) state after bailout in ??=
--FILE--
<?php
register_shutdown_function(function() {
include __DIR__ . '/gh11108_shutdown.inc';
});
include __DIR__ . '/gh11108_test.inc';
?>
--EXPECTF--
Fatal error: Cannot use [] for reading in %s on line %d

5
Zend/tests/gh11108_shutdown.inc Normal file
View file

@ -0,0 +1,5 @@
<?php
function test() {
throw new Exception();
}

3
Zend/tests/gh11108_test.inc Normal file
View file

@ -0,0 +1,3 @@
<?php
$messageList[] ??= true;

1
Zend/zend.c
View file

@ -1192,6 +1192,7 @@ ZEND_API ZEND_COLD ZEND_NORETURN void _zend_bailout(const char *filename, uint32
CG(unclean_shutdown) = 1; CG(unclean_shutdown) = 1;
CG(active_class_entry) = NULL; CG(active_class_entry) = NULL;
CG(in_compilation) = 0; CG(in_compilation) = 0;
CG(memoize_mode) = 0;
EG(current_execute_data) = NULL; EG(current_execute_data) = NULL;
LONGJMP(*EG(bailout), FAILURE); LONGJMP(*EG(bailout), FAILURE);
} }