diff --git a/Zend/tests/generators/errors/resume_running_generator_error_003.phpt b/Zend/tests/generators/errors/resume_running_generator_error_003.phpt new file mode 100644 index 00000000000..c72f9ba8725 --- /dev/null +++ b/Zend/tests/generators/errors/resume_running_generator_error_003.phpt @@ -0,0 +1,24 @@ +--TEST-- +Use-after-free when resume an already running generator +--FILE-- +send($y); +} +$gen=gen(); +try { + $gen->send($gen); +}catch(y) { +} +?> +--EXPECTF-- +Warning: Undefined variable $y in %sresume_running_generator_error_003.php on line 4 + +Fatal error: Uncaught Error: Cannot resume an already running generator in %sresume_running_generator_error_003.php:4 +Stack trace: +#0 %sresume_running_generator_error_003.php(4): Generator->send(NULL) +#1 [internal function]: gen() +#2 %sresume_running_generator_error_003.php(8): Generator->send(Object(Generator)) +#3 {main} + thrown in %sresume_running_generator_error_003.php on line 4 diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c index a5fcad31dfe..c73563ec2f3 100644 --- a/Zend/zend_generators.c +++ b/Zend/zend_generators.c @@ -937,8 +937,7 @@ ZEND_METHOD(Generator, send) root = zend_generator_get_current(generator); /* Put sent value in the target VAR slot, if it is used */ - if (root->send_target) { - zval_ptr_dtor(root->send_target); + if (root->send_target && !(root->flags & ZEND_GENERATOR_CURRENTLY_RUNNING)) { ZVAL_COPY(root->send_target, value); }