archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3' into PHP-8.4

Browse source 
* PHP-8.3:
  Fix GH-19303: Unpacking empty packed array into uninitialized array causes assertion failure
This commit is contained in:
Niels Dossche 2025-07-30 22:48:59 +02:00
commit a08df32f18
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
4 changed files with 45 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -15,6 +15,8 @@ PHP NEWS
binary const expr). (ilutov) binary const expr). (ilutov)
. Fixed bug GH-19305 (Operands may be being released during comparison). . Fixed bug GH-19305 (Operands may be being released during comparison).
(Arnaud) (Arnaud)
. Fixed bug GH-19303 (Unpacking empty packed array into uninitialized array
causes assertion failure). (nielsdos)
- FTP: - FTP:
. Fix theoretical issues with hrtime() not being available. (nielsdos) . Fix theoretical issues with hrtime() not being available. (nielsdos)

11
Zend/tests/array_unpack/gh19303.phpt Normal file
View file

@ -0,0 +1,11 @@
--TEST--
GH-19303 (Unpacking empty packed array into uninitialized array causes assertion failure)
--FILE--
<?php
$a = [0];
unset($a[0]);
var_dump([...$a]);
?>
--EXPECT--
array(0) {
}

5
Zend/zend_vm_def.h
View file

@ -6262,6 +6262,10 @@ ZEND_VM_C_LABEL(add_unpack_again):
zval *val; zval *val;
if (HT_IS_PACKED(ht) && (zend_hash_num_elements(result_ht) == 0 || HT_IS_PACKED(result_ht))) { if (HT_IS_PACKED(ht) && (zend_hash_num_elements(result_ht) == 0 || HT_IS_PACKED(result_ht))) {
/* zend_hash_extend() skips initialization when the number of elements is 0,
* but the code below expects that result_ht is initialized as packed.
* We can just skip the work in that case. */
if (result_ht->nNumUsed + zend_hash_num_elements(ht) > 0) {
zend_hash_extend(result_ht, result_ht->nNumUsed + zend_hash_num_elements(ht), 1); zend_hash_extend(result_ht, result_ht->nNumUsed + zend_hash_num_elements(ht), 1);
ZEND_HASH_FILL_PACKED(result_ht) { ZEND_HASH_FILL_PACKED(result_ht) {
ZEND_HASH_PACKED_FOREACH_VAL(ht, val) { ZEND_HASH_PACKED_FOREACH_VAL(ht, val) {
@ -6273,6 +6277,7 @@ ZEND_VM_C_LABEL(add_unpack_again):
ZEND_HASH_FILL_ADD(val); ZEND_HASH_FILL_ADD(val);
} ZEND_HASH_FOREACH_END(); } ZEND_HASH_FOREACH_END();
} ZEND_HASH_FILL_END(); } ZEND_HASH_FILL_END();
}
} else { } else {
zend_string *key; zend_string *key;

5
Zend/zend_vm_execute.h generated
View file

@ -2721,6 +2721,10 @@ add_unpack_again:
zval *val; zval *val;
if (HT_IS_PACKED(ht) && (zend_hash_num_elements(result_ht) == 0 || HT_IS_PACKED(result_ht))) { if (HT_IS_PACKED(ht) && (zend_hash_num_elements(result_ht) == 0 || HT_IS_PACKED(result_ht))) {
/* zend_hash_extend() skips initialization when the number of elements is 0,
* but the code below expects that result_ht is initialized as packed.
* We can just skip the work in that case. */
if (result_ht->nNumUsed + zend_hash_num_elements(ht) > 0) {
zend_hash_extend(result_ht, result_ht->nNumUsed + zend_hash_num_elements(ht), 1); zend_hash_extend(result_ht, result_ht->nNumUsed + zend_hash_num_elements(ht), 1);
ZEND_HASH_FILL_PACKED(result_ht) { ZEND_HASH_FILL_PACKED(result_ht) {
ZEND_HASH_PACKED_FOREACH_VAL(ht, val) { ZEND_HASH_PACKED_FOREACH_VAL(ht, val) {
@ -2732,6 +2736,7 @@ add_unpack_again:
ZEND_HASH_FILL_ADD(val); ZEND_HASH_FILL_ADD(val);
} ZEND_HASH_FOREACH_END(); } ZEND_HASH_FOREACH_END();
} ZEND_HASH_FILL_END(); } ZEND_HASH_FILL_END();
}
} else { } else {
zend_string *key; zend_string *key;