archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed bug #80781

Browse source 
zend_find_array_dim_slow() may throw, make sure to handle this.
This backports the code we already use for this on PHP-8.0,
and also backports an exception check that makes this easier to
catch.
This commit is contained in:
Nikita Popov 2021-02-22 09:33:23 +01:00
parent 84b6152842
commit 6dd85f83f7
5 changed files with 77 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -2,6 +2,10 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? 2021, php 7.4.17
- Core:
. Fixed bug #80781 (Error handler that throws ErrorException infinite loop).
(Nikita)
- Intl:
. Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
(cmb)

32
Zend/tests/bug80781.phpt Normal file
View file

@ -0,0 +1,32 @@
--TEST--
Bug #80781: Error handler that throws ErrorException infinite loop
--FILE--
<?php
function handle(int $severity, string $message, string $file, int $line): bool {
if((error_reporting() & $severity) !== 0) {
throw new \ErrorException($message, 0, $severity, $file, $line);
}
return true; // stfu operator
}
set_error_handler('handle');
function getPlugin(string $plugin) : bool{
return false;
}
$data = [];
$array = [];
if (isset($array[$data]) or getPlugin($data)) {
}
?>
--EXPECTF--
Fatal error: Uncaught ErrorException: Illegal offset type in isset or empty in %s:%d
Stack trace:
#0 %s(%d): handle(2, 'Illegal offset ...', %s, %d, Array)
#1 {main}
thrown in %s on line %d

1
Zend/zend_execute.c
View file

@ -4555,6 +4555,7 @@ static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame(uint
if (check_exception) { \
OPLINE = EX(opline) + (skip); \
} else { \
ZEND_ASSERT(!EG(exception)); \
OPLINE = opline + (skip); \
} \
ZEND_VM_CONTINUE()

4
Zend/zend_vm_def.h
View file

@ -6937,6 +6937,10 @@ ZEND_VM_C_LABEL(num_index_prop):
ZEND_VM_C_GOTO(isset_again);
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
ZEND_VM_C_GOTO(isset_dim_obj_exit);
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {

36
Zend/zend_vm_execute.h
View file

@ -6302,6 +6302,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -8496,6 +8500,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -10949,6 +10957,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -14985,6 +14997,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -16402,6 +16418,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -17689,6 +17709,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -41505,6 +41529,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -44950,6 +44978,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {
@ -50123,6 +50155,10 @@ num_index_prop:
goto isset_again;
} else {
value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
if (UNEXPECTED(EG(exception))) {
result = 0;
goto isset_dim_obj_exit;
}
}
if (!(opline->extended_value & ZEND_ISEMPTY)) {