archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3' into PHP-8.4

Browse source 
* PHP-8.3:
  Fix uaf in SplFixedArray::unset()
This commit is contained in:
Ilija Tovilo 2024-10-17 18:25:56 +02:00
commit c82cea0c34
No known key found for this signature in database
GPG key ID: 5050C66BFCD1015A
3 changed files with 25 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -85,6 +85,7 @@ PHP NEWS
. Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()). . Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
(ilutov) (ilutov)
. Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov) . Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov)
. Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov)
- Standard: - Standard:
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with . Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with

4
ext/spl/spl_fixedarray.c
View file

@ -459,8 +459,10 @@ static void spl_fixedarray_object_unset_dimension_helper(spl_fixedarray_object *
zend_throw_exception(spl_ce_OutOfBoundsException, "Index invalid or out of range", 0); zend_throw_exception(spl_ce_OutOfBoundsException, "Index invalid or out of range", 0);
return; return;
} else { } else {
zval_ptr_dtor(&(intern->array.elements[index])); zval garbage;
ZVAL_COPY_VALUE(&garbage, &intern->array.elements[index]);
ZVAL_NULL(&intern->array.elements[index]); ZVAL_NULL(&intern->array.elements[index]);
zval_ptr_dtor(&garbage);
} }
} }

21
ext/spl/tests/gh16478.phpt Normal file
View file

@ -0,0 +1,21 @@
--TEST--
GH-16478: Use-after-free in SplFixedArray::unset()
--FILE--
<?php
class C {
function __destruct() {
global $arr;
$arr->setSize(0);
}
}
$arr = new SplFixedArray(2);
$arr[0] = new C;
unset($arr[0]);
var_dump($arr);
?>
--EXPECT--
object(SplFixedArray)#1 (0) {
}