archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix too early terminated temporary range with break/cont/goto

Browse source 
I have no crashing or leaking reproduce script, only valgrind invalid reads for that one; hence no phpt here
This commit is contained in:
Bob Weinand 2015-07-09 20:07:40 +02:00
parent 9591b1cc3c
commit cc876c04b4
5 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Zend/zend_compile.c
View file

@ -3482,7 +3482,7 @@ void zend_compile_return(zend_ast *ast) /* {{{ */
zend_emit_return_type_check(expr_ast ? &expr_node : NULL, CG(active_op_array)->arg_info - 1); zend_emit_return_type_check(expr_ast ? &expr_node : NULL, CG(active_op_array)->arg_info - 1);
} }
zend_free_foreach_and_switch_variables(ZEND_FREE_ON_RETURN); zend_free_foreach_and_switch_variables(ZEND_FREE_ON_JUMP);
if (CG(context).in_finally) { if (CG(context).in_finally) {
opline = zend_emit_op(NULL, ZEND_DISCARD_EXCEPTION, NULL, NULL); opline = zend_emit_op(NULL, ZEND_DISCARD_EXCEPTION, NULL, NULL);
@ -3567,7 +3567,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
} }
if (nest_level > 1) { if (nest_level > 1) {
generate_free_loop_var(&CG(context).brk_cont_array[array_offset].loop_var); generate_free_loop_var_ex(&CG(context).brk_cont_array[array_offset].loop_var, ZEND_FREE_ON_JUMP);
} }
array_offset = CG(context).brk_cont_array[array_offset].parent; array_offset = CG(context).brk_cont_array[array_offset].parent;
@ -3637,7 +3637,7 @@ void zend_resolve_goto_label(zend_op_array *op_array, znode *label_node, zend_op
if (pass2_opline) { if (pass2_opline) {
free_vars++; free_vars++;
} else { } else {
generate_free_loop_var(&CG(context).brk_cont_array[current].loop_var); generate_free_loop_var_ex(&CG(context).brk_cont_array[current].loop_var, ZEND_FREE_ON_JUMP);
} }
} }
current = CG(context).brk_cont_array[current].parent; current = CG(context).brk_cont_array[current].parent;

2
Zend/zend_compile.h
View file

@ -882,7 +882,7 @@ ZEND_API void zend_assert_valid_class_name(const zend_string *const_name);
#define ZEND_FETCH_ARG_MASK 0x000fffff #define ZEND_FETCH_ARG_MASK 0x000fffff
#define ZEND_FREE_ON_RETURN (1<<0) #define ZEND_FREE_ON_JUMP (1<<0)
#define ZEND_MEMBER_FUNC_CALL (1<<0) #define ZEND_MEMBER_FUNC_CALL (1<<0)

4
Zend/zend_opcode.c
View file

@ -994,8 +994,8 @@ static zend_always_inline uint32_t *generate_var_liveliness_info_ex(zend_op_arra
&& opline->opcode != ZEND_FE_FETCH_RW && opline->opcode != ZEND_FE_FETCH_RW
/* the following opcodes are parts of "return" statement */ /* the following opcodes are parts of "return" statement */
&& opline->opcode != ZEND_VERIFY_RETURN_TYPE && opline->opcode != ZEND_VERIFY_RETURN_TYPE
&& (opline->opcode != ZEND_FREE || !(opline->extended_value & ZEND_FREE_ON_RETURN)) && (opline->opcode != ZEND_FREE || !(opline->extended_value & ZEND_FREE_ON_JUMP))
&& (opline->opcode != ZEND_FE_FREE || !(opline->extended_value & ZEND_FREE_ON_RETURN)) && (opline->opcode != ZEND_FE_FREE || !(opline->extended_value & ZEND_FREE_ON_JUMP))
) { ) {
op_live_total += liveliness_kill_var(op_array, opline, var, Tstart, opTs); op_live_total += liveliness_kill_var(op_array, opline, var, Tstart, opTs);
} }

4
Zend/zend_vm_def.h
View file

@ -7084,8 +7084,8 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
if (catch_op_num || finally_op_num) { if (catch_op_num || finally_op_num) {
if (EX(func)->op_array.opcodes[op_num].opcode == ZEND_VERIFY_RETURN_TYPE if (EX(func)->op_array.opcodes[op_num].opcode == ZEND_VERIFY_RETURN_TYPE
|| (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_RETURN)) || (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_JUMP))
|| (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FE_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_RETURN)) || (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FE_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_JUMP))
) { ) {
catch_op_num = finally_op_num = 0; catch_op_num = finally_op_num = 0;
} }

4
Zend/zend_vm_execute.h
View file

@ -1502,8 +1502,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
if (catch_op_num || finally_op_num) { if (catch_op_num || finally_op_num) {
if (EX(func)->op_array.opcodes[op_num].opcode == ZEND_VERIFY_RETURN_TYPE if (EX(func)->op_array.opcodes[op_num].opcode == ZEND_VERIFY_RETURN_TYPE
|| (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_RETURN)) || (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_JUMP))
|| (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FE_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_RETURN)) || (EX(func)->op_array.opcodes[op_num].opcode == ZEND_FE_FREE && (EX(func)->op_array.opcodes[op_num].extended_value & ZEND_FREE_ON_JUMP))
) { ) {
catch_op_num = finally_op_num = 0; catch_op_num = finally_op_num = 0;
} }