-
Notifications
You must be signed in to change notification settings - Fork 7.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
The problem is that we're using the variable_ptr in the opcode handler *after* it has already been destroyed. The solution is to create a specialised version of zend_assign_to_variable which takes in two destination zval pointers. Closes GH-10524
- Loading branch information
Showing
8 changed files
with
486 additions
and
193 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| --TEST-- | ||
| GH-10168 (heap-buffer-overflow at zval_undefined_cv): array variation | ||
| --FILE-- | ||
| <?php | ||
|
|
||
| class Test | ||
| { | ||
| static $instances; | ||
| public function __construct() { | ||
| (self::$instances[NULL] = $this) > 0; | ||
| var_dump(self::$instances); | ||
| } | ||
|
|
||
| function __destruct() { | ||
| unset(self::$instances[NULL]); | ||
| } | ||
| } | ||
| new Test(); | ||
| new Test(); | ||
|
|
||
| ?> | ||
| --EXPECTF-- | ||
| Notice: Object of class Test could not be converted to int in %s on line %d | ||
| array(1) { | ||
| [""]=> | ||
| object(Test)#1 (0) { | ||
| } | ||
| } | ||
|
|
||
| Notice: Object of class Test could not be converted to int in %s on line %d | ||
| array(0) { | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| --TEST-- | ||
| GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign global variation | ||
| --FILE-- | ||
| <?php | ||
|
|
||
| $a = null; | ||
|
|
||
| class Test | ||
| { | ||
| public function __construct() { | ||
| ($GLOBALS['a'] = $this) > 0; | ||
| // Destructor called after comparison, so a will be NULL | ||
| var_dump($GLOBALS['a']); | ||
| } | ||
|
|
||
| function __destruct() { | ||
| unset($GLOBALS['a']); | ||
| } | ||
| } | ||
| new Test(); | ||
| new Test(); | ||
|
|
||
| ?> | ||
| --EXPECTF-- | ||
| Notice: Object of class Test could not be converted to int in %s on line %d | ||
| object(Test)#1 (0) { | ||
| } | ||
|
|
||
| Notice: Object of class Test could not be converted to int in %s on line %d | ||
|
|
||
| Warning: Undefined global variable $a in %s on line %d | ||
| NULL |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| --TEST-- | ||
| GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop | ||
| --FILE-- | ||
| <?php | ||
| class Test | ||
| { | ||
| static ?Test $a = null; | ||
|
|
||
| public function __construct() { | ||
| if (self::$a === null) { | ||
| var_dump(self::$a = &$this); | ||
| } else { | ||
| var_dump(self::$a = $this); | ||
| } | ||
| } | ||
|
|
||
| function __destruct() { | ||
| self::$a = null; | ||
| } | ||
| } | ||
| new Test(); | ||
| new Test(); | ||
|
|
||
| ?> | ||
| --EXPECTF-- | ||
| object(Test)#1 (0) { | ||
| } | ||
| object(Test)#2 (0) { | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
71ddedeThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Zend/tests/gh10168_3.phptfails on master on 32bits.71ddedeThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Girgias Thanks, I'm on it.