archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Check for null EX(func) in write_property

Browse source 
This can happen if zend_call_function inserted a dummy frame,
and we already switched to the dummy frame in leave_helper,
and an exception is thrown during CV destruction.

Fixes oss-fuzz #25343.
This commit is contained in:
Nikita Popov 2020-09-01 15:14:32 +02:00
parent 37612936a1
commit f92a03627a
2 changed files with 35 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

25
Zend/tests/ex_func_null_during_property_write.phpt Normal file
View file

@ -0,0 +1,25 @@
--TEST--
EX(func) can be null during write_property in an edge case
--FILE--
<?php
class a {
public static $i = 0;
function __destruct() {
if (self::$i++ != 0) throw new Exception;
$b = new a;
echo $b;
}
}
new a;
?>
--EXPECTF--
Fatal error: Uncaught Error: Object of class a could not be converted to string in %s:%d
Stack trace:
#0 %s(%d): a->__destruct()
#1 {main}
Next Exception in %s:%d
Stack trace:
#0 %s(%d): a->__destruct()
#1 {main}
thrown in %s on line %d

13
Zend/zend_object_handlers.c
View file

@ -809,6 +809,13 @@ exit:
}
/* }}} */
static zend_always_inline zend_bool property_uses_strict_types() {
zend_execute_data *execute_data = EG(current_execute_data);
return execute_data
&& execute_data->func
&& ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data));
}
ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value, void **cache_slot) /* {{{ */
{
zend_object *zobj;
@ -833,7 +840,7 @@ ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value,
if (UNEXPECTED(prop_info)) {
ZVAL_COPY_VALUE(&tmp, value);
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
Z_TRY_DELREF_P(value);
variable_ptr = &EG(error_zval);
goto exit;
@ -842,7 +849,7 @@ ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value,
}
found:
zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)));
zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, property_uses_strict_types());
goto exit;
}
if (Z_PROP_FLAG_P(variable_ptr) == IS_PROP_UNINIT) {
@ -898,7 +905,7 @@ write_std_property:
if (UNEXPECTED(prop_info)) {
ZVAL_COPY_VALUE(&tmp, value);
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
zval_ptr_dtor(value);
goto exit;
}