Fix incorrect optimization that leads to memory leak

Fixes oss-fuzz #42221
php · Dec 13, 2021 · 230de77 · 230de77
1 parent e79dbe1
commit 230de77
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/ext/opcache/Optimizer/sccp.c b/ext/opcache/Optimizer/sccp.c
@@ -2279,7 +2279,9 @@ static int try_remove_definition(sccp_ctx *ctx, int var_num, zend_ssa_var *var,
 					removed_ops = remove_call(ctx, opline, ssa_op);
 				} else if (opline->opcode == ZEND_TYPE_CHECK
 						&& (opline->op1_type & (IS_VAR|IS_TMP_VAR))
-						&& !value_known(&ctx->values[ssa_op->op1_use])) {
+						&& (!value_known(&ctx->values[ssa_op->op1_use])
+							|| IS_PARTIAL_ARRAY(&ctx->values[ssa_op->op1_use])
+							|| IS_PARTIAL_OBJECT(&ctx->values[ssa_op->op1_use]))) {
 					/* For TYPE_CHECK we may compute the result value without knowing the
 					 * operand, based on type inference information. Make sure the operand is
 					 * freed and leave further cleanup to DCE. */

diff --git a/ext/opcache/tests/opt/sccp_034.phpt b/ext/opcache/tests/opt/sccp_034.phpt
@@ -0,0 +1,16 @@
+--TEST--
+SCCP 034: memory leak
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+is_array(["$y $y"]);
+?>
+DONE
+--EXPECTF--
+Warning: Undefined variable $y in %ssccp_034.php on line 2
+
+Warning: Undefined variable $y in %ssccp_034.php on line 2
+DONE