archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix segfault when assigning to backing value by-ref from hook

Browse source 
Fixes oss-fuzz #391975641
Closes GH-17620
This commit is contained in:
Ilija Tovilo 2025-01-29 12:48:35 +01:00
parent 47a0922dee
commit ab6977d36c
No known key found for this signature in database
GPG key ID: 5050C66BFCD1015A
3 changed files with 25 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -11,6 +11,8 @@ PHP NEWS
. Fixed bug GH-17618 (UnhandledMatchError does not take
zend.exception_ignore_args=1 into account). (timwolla)
. Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
. Fixed bug OSS-Fuzz #391975641 (Crash when accessing property backing value
by reference). (ilutov)
- DOM:
. Fixed bug GH-17609 (Typo in error message: Dom\NO_DEFAULT_NS instead of

22
Zend/tests/oss-fuzz-391975641.phpt Normal file
View file

@ -0,0 +1,22 @@
--TEST--
OSS-Fuzz #391975641: Segfault when creating reference from backing value
--FILE--
<?php
class C {
public $prop {
get => $this->prop;
set {
$this->prop = &$value;
$value = &$this->prop;
}
}
}
$c = new C;
$c->prop = 1;
var_dump($c->prop);
?>
--EXPECT--
int(1)

2
Zend/zend_execute.c
View file

@ -3490,7 +3490,7 @@ static zend_always_inline void zend_assign_to_property_reference(zval *container
variable_ptr = zend_wrong_assign_to_variable_reference(
variable_ptr, value_ptr, &garbage OPLINE_CC EXECUTE_DATA_CC);
} else if (prop_info) {
} else if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
variable_ptr = zend_assign_to_typed_property_reference(prop_info, variable_ptr, value_ptr, &garbage EXECUTE_DATA_CC);
} else {
zend_assign_to_variable_reference(variable_ptr, value_ptr, &garbage);