archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.1' into PHP-8.2

Browse source 
* PHP-8.1:
  Fix double-free of doc_comment when overriding static property via trait
This commit is contained in:
Ilija Tovilo 2023-10-19 15:23:00 +02:00
commit 4f1f77c51b
No known key found for this signature in database
GPG key ID: A4F5D403F118200A
4 changed files with 41 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -6,6 +6,8 @@ PHP NEWS
. Fixed double-free of non-interned enum case name. (ilutov)
. Fixed bug GH-12457 (Incorrect result of stripos with single character
needle). (SakiTakamachi)
. Fixed bug GH-12468 (Double-free of doc_comment when overriding static
property via trait). (ilutov)
- DOM:
. Fix registerNodeClass with abstract class crashing. (nielsdos)

18
Zend/tests/gh12468_1.phpt Normal file
View file

@ -0,0 +1,18 @@
--TEST--
GH-12468: Double-free of doc_comment when overriding static property via trait
--FILE--
<?php
trait T {
/** some doc */
static protected $a = 0;
}
class A {
use T;
}
class B extends A {
use T;
}
?>
===DONE===
--EXPECT--
===DONE===

19
Zend/tests/gh12468_2.phpt Normal file
View file

@ -0,0 +1,19 @@
--TEST--
GH-12468: Double-free of doc_comment when overriding static property via trait
--FILE--
<?php
trait T {
/** some doc */
static protected $a = 0;
}
class A {
/** some doc */
static protected $a = 0;
}
class B extends A {
use T;
}
?>
===DONE===
--EXPECT--
===DONE===

4
Zend/zend_API.c
View file

@ -4199,7 +4199,7 @@ ZEND_API zend_property_info *zend_declare_typed_property(zend_class_entry *ce, z
(property_info_ptr->flags & ZEND_ACC_STATIC) != 0) {
property_info->offset = property_info_ptr->offset;
zval_ptr_dtor(&ce->default_static_members_table[property_info->offset]);
if (property_info_ptr->doc_comment) {
if (property_info_ptr->doc_comment && property_info_ptr->ce == ce) {
zend_string_release(property_info_ptr->doc_comment);
}
zend_hash_del(&ce->properties_info, name);
@ -4220,7 +4220,7 @@ ZEND_API zend_property_info *zend_declare_typed_property(zend_class_entry *ce, z
(property_info_ptr->flags & ZEND_ACC_STATIC) == 0) {
property_info->offset = property_info_ptr->offset;
zval_ptr_dtor(&ce->default_properties_table[OBJ_PROP_TO_NUM(property_info->offset)]);
if (property_info_ptr->doc_comment) {
if (property_info_ptr->doc_comment && property_info_ptr->ce == ce) {
zend_string_release_ex(property_info_ptr->doc_comment, 1);
}
zend_hash_del(&ce->properties_info, name);