archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed bug #78774

Browse source 
The string held by the zend_type may be released if the property
type gets resolved to a CE. I initially wanted to fix this by
storing a zend_type* instead (so the property type resolution
propagates to the ReflectionType), but decided against this in
light of upcoming union types support, where we also need to
represent parts of the union, and will not have a single zend_type*
we can reference.
This commit is contained in:
Nikita Popov 2019-11-04 11:01:56 +01:00
parent e84042cc72
commit c9abfaec6b
3 changed files with 38 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -9,6 +9,9 @@ PHP NEWS
. Fixed bug #77930 (stream_copy_to_stream should use mmap more often).
(Nikita)
- Reflection:
. Fixed bug #78774 (ReflectionNamedType on Typed Properties Crash). (Nikita)
31 Oct 2019, PHP 7.4.0RC5
- Core:

14
ext/reflection/php_reflection.c
View file

@ -224,8 +224,14 @@ static void reflection_free_objects_storage(zend_object *object) /* {{{ */
efree(intern->ptr);
break;
case REF_TYPE_TYPE:
efree(intern->ptr);
{
type_reference *type_ref = intern->ptr;
if (ZEND_TYPE_IS_NAME(type_ref->type)) {
zend_string_release(ZEND_TYPE_NAME(type_ref->type));
}
efree(type_ref);
break;
}
case REF_TYPE_FUNCTION:
_free_function(intern->ptr);
break;
@ -1152,6 +1158,12 @@ static void reflection_type_factory(zend_type type, zval *object)
reference->type = type;
intern->ptr = reference;
intern->ref_type = REF_TYPE_TYPE;
/* Property types may be resolved during the lifetime of the ReflectionType,
* so we need to make sure that the strings we reference are not released. */
if (ZEND_TYPE_IS_NAME(type)) {
zend_string_addref(ZEND_TYPE_NAME(type));
}
}
/* }}} */

22
ext/reflection/tests/bug78774.phpt Normal file
View file

@ -0,0 +1,22 @@
--TEST--
Bug #78774: ReflectionNamedType on Typed Properties Crash
--FILE--
<?php
class Test {
public stdClass $prop;
}
$rc = new ReflectionClass(Test::class);
$rp = $rc->getProperty('prop');
$rt = $rp->getType();
// Force a resolution of the property type
$test = new Test;
$test->prop = new stdClass;
var_dump($rt->getName());
?>
--EXPECT--
string(8) "stdClass"