-
Notifications
You must be signed in to change notification settings - Fork 7.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix use after free when WeakMap is modified during field write
(When a value's destructor triggers a resizing or rehashing of the WeakMap) Closes GH-7671
- Loading branch information
1 parent
2f8407f
commit 241bd3f
Showing
2 changed files
with
121 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,116 @@ | ||
--TEST-- | ||
WeakReference overwriting existing value | ||
--FILE-- | ||
<?php | ||
|
||
class HasDtor { | ||
public function __destruct() { | ||
echo "In destruct\n"; | ||
global $w, $all; | ||
for ($i = 0; $i < 10; $i++) { | ||
$v = new stdClass(); | ||
$all[] = $v; | ||
$w[$v] = $i; | ||
} | ||
} | ||
} | ||
$all = []; | ||
$w = new WeakMap(); | ||
$o = new stdClass(); | ||
|
||
$w[$o] = new HasDtor(); | ||
$w[$o] = 123; | ||
var_dump($w); | ||
?> | ||
--EXPECT-- | ||
In destruct | ||
object(WeakMap)#1 (11) { | ||
[0]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#2 (0) { | ||
} | ||
["value"]=> | ||
int(123) | ||
} | ||
[1]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#4 (0) { | ||
} | ||
["value"]=> | ||
int(0) | ||
} | ||
[2]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#5 (0) { | ||
} | ||
["value"]=> | ||
int(1) | ||
} | ||
[3]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#6 (0) { | ||
} | ||
["value"]=> | ||
int(2) | ||
} | ||
[4]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#7 (0) { | ||
} | ||
["value"]=> | ||
int(3) | ||
} | ||
[5]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#8 (0) { | ||
} | ||
["value"]=> | ||
int(4) | ||
} | ||
[6]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#9 (0) { | ||
} | ||
["value"]=> | ||
int(5) | ||
} | ||
[7]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#10 (0) { | ||
} | ||
["value"]=> | ||
int(6) | ||
} | ||
[8]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#11 (0) { | ||
} | ||
["value"]=> | ||
int(7) | ||
} | ||
[9]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#12 (0) { | ||
} | ||
["value"]=> | ||
int(8) | ||
} | ||
[10]=> | ||
array(2) { | ||
["key"]=> | ||
object(stdClass)#13 (0) { | ||
} | ||
["value"]=> | ||
int(9) | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters