archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.4'

Browse source 
* PHP-7.4:
  Check for null EX(func) in write_property
This commit is contained in:
Nikita Popov 2020-09-01 15:17:28 +02:00
commit 88a8ebce6a
2 changed files with 35 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

25
Zend/tests/ex_func_null_during_property_write.phpt Normal file
View file

@ -0,0 +1,25 @@
--TEST--
EX(func) can be null during write_property in an edge case
--FILE--
<?php
class a {
public static $i = 0;
function __destruct() {
if (self::$i++ != 0) throw new Exception;
$b = new a;
echo $b;
}
}
new a;
?>
--EXPECTF--
Fatal error: Uncaught Error: Object of class a could not be converted to string in %s:%d
Stack trace:
#0 %s(%d): a->__destruct()
#1 {main}
Next Exception in %s:%d
Stack trace:
#0 %s(%d): a->__destruct()
#1 {main}
thrown in %s on line %d

13
Zend/zend_object_handlers.c
View file

@ -691,6 +691,13 @@ exit:
}
/* }}} */
static zend_always_inline zend_bool property_uses_strict_types() {
zend_execute_data *execute_data = EG(current_execute_data);
return execute_data
&& execute_data->func
&& ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data));
}
ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zval *value, void **cache_slot) /* {{{ */
{
zval *variable_ptr, tmp;
@ -707,7 +714,7 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva
if (UNEXPECTED(prop_info)) {
ZVAL_COPY_VALUE(&tmp, value);
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
Z_TRY_DELREF_P(value);
variable_ptr = &EG(error_zval);
goto exit;
@ -716,7 +723,7 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva
}
found:
zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)));
zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, property_uses_strict_types());
goto exit;
}
if (Z_PROP_FLAG_P(variable_ptr) == IS_PROP_UNINIT) {
@ -772,7 +779,7 @@ write_std_property:
if (UNEXPECTED(prop_info)) {
ZVAL_COPY_VALUE(&tmp, value);
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
zval_ptr_dtor(value);
goto exit;
}