archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Make weak ref notify robust against bailout

Browse source 
First drop it from EG(weakrefs), as the weakref_unref operation
may call a destructor, which may bail out.

Fixes oss-fuzz #39718.
This commit is contained in:
Nikita Popov 2021-10-08 16:42:43 +02:00
parent d001682ac4
commit a4b209fdcf
2 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Zend/tests/weakrefs/weakmap_dtor_exception.phpt Normal file
View file

@ -0,0 +1,18 @@
--TEST--
Exception during WeakMap destruction during shutdown
--FILE--
<?php
$map = new WeakMap;
$obj = new stdClass;
$map[$obj] = new class {
function __destruct() {
throw new Exception("Test");
}
};
?>
--EXPECTF--
Fatal error: Uncaught Exception: Test in %s:%d
Stack trace:
#0 [internal function]: class@anonymous->__destruct()
#1 {main}
thrown in %s on line %d

2
Zend/zend_weakrefs.c
View file

@ -157,8 +157,8 @@ void zend_weakrefs_notify(zend_object *object) {
ZEND_ASSERT(tagged_ptr && "Tracking of the IS_OBJ_WEAKLY_REFERENCE flag should be precise"); ZEND_ASSERT(tagged_ptr && "Tracking of the IS_OBJ_WEAKLY_REFERENCE flag should be precise");
#endif #endif
if (tagged_ptr) { if (tagged_ptr) {
zend_weakref_unref(obj_addr, tagged_ptr);
zend_hash_index_del(&EG(weakrefs), obj_addr); zend_hash_index_del(&EG(weakrefs), obj_addr);
zend_weakref_unref(obj_addr, tagged_ptr);
} }
} }