archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.1'

Browse source 
* PHP-8.1:
  Fix use after free
This commit is contained in:
Dmitry Stogov 2022-03-01 01:34:27 +03:00
commit 83d96d6779
2 changed files with 25 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

24
Zend/tests/generators/errors/resume_running_generator_error_003.phpt Normal file
View file

@ -0,0 +1,24 @@
--TEST--
Use-after-free when resume an already running generator
--FILE--
<?php
function gen(){
$g = yield;
$g->send($y);
}
$gen=gen();
try {
$gen->send($gen);
}catch(y) {
}
?>
--EXPECTF--
Warning: Undefined variable $y in %sresume_running_generator_error_003.php on line 4
Fatal error: Uncaught Error: Cannot resume an already running generator in %sresume_running_generator_error_003.php:4
Stack trace:
#0 %sresume_running_generator_error_003.php(4): Generator->send(NULL)
#1 [internal function]: gen()
#2 %sresume_running_generator_error_003.php(8): Generator->send(Object(Generator))
#3 {main}
thrown in %sresume_running_generator_error_003.php on line 4

3
Zend/zend_generators.c
View file

@ -937,8 +937,7 @@ ZEND_METHOD(Generator, send)
root = zend_generator_get_current(generator);
/* Put sent value in the target VAR slot, if it is used */
if (root->send_target) {
zval_ptr_dtor(root->send_target);
if (root->send_target && !(root->flags & ZEND_GENERATOR_CURRENTLY_RUNNING)) {
ZVAL_COPY(root->send_target, value);
}