archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.3' into PHP-7.4

Browse source 
* PHP-7.3:
  Fixed bug #78379 (Cast to object confuses GC, causes crash)
This commit is contained in:
Dmitry Stogov 2019-08-08 10:07:39 +03:00
commit 720438c8ee
3 changed files with 38 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -11,6 +11,7 @@ PHP NEWS
. Fixed bug #78344 (Segmentation fault on zend_check_protected). (Nikita)
. Fixed bug #78356 (Array returned from ArrayAccess is incorrectly unpacked
as argument). (Nikita)
. Fixed bug #78379 (Cast to object confuses GC, causes crash). (Dmitry)
- Exif:
. Fixed bug #78333 (Exif crash (bus error) due to wrong alignment and

32
Zend/tests/bug78379.phpt Normal file
View file

@ -0,0 +1,32 @@
--TEST--
Bug #78379 (Cast to object confuses GC, causes crash)
--INI--
opcache.enable=0
--FILE--
<?php
class C {
public function __construct() {
$this->p = (object)["x" => [1]];
}
}
class E {
}
$e = new E;
$e->f = new E;
$e->f->e = $e;
$e->a = new C;
$e = null;
gc_collect_cycles();
var_dump(new C);
?>
--EXPECTF--
object(C)#%d (1) {
["p"]=>
object(stdClass)#%d (1) {
["x"]=>
array(1) {
[0]=>
int(1)
}
}
}

5
Zend/zend_object_handlers.c
View file

@ -127,6 +127,11 @@ ZEND_API HashTable *zend_std_get_gc(zval *object, zval **table, int *n) /* {{{ *
if (zobj->properties) {
*table = NULL;
*n = 0;
if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)
&& EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
GC_DELREF(zobj->properties);
zobj->properties = zend_array_dup(zobj->properties);
}
return zobj->properties;
} else {
*table = zobj->properties_table;