Skip to content

Commit 969e837

Browse files
authored
Fix compiler segfault during call compilation (#20054)
Happens due to changes in 28fd759 where the opline opcode may be accessed after the opcode array has been reallocated. To solve this we store the opcode in a temporary variable.
1 parent d2fcf04 commit 969e837

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

Zend/zend_compile.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3956,19 +3956,21 @@ static bool zend_compile_call_common(znode *result, zend_ast *args_ast, zend_fun
39563956
if (args_ast->kind == ZEND_AST_CALLABLE_CONVERT) {
39573957
opline = &CG(active_op_array)->opcodes[opnum_init];
39583958
opline->extended_value = 0;
3959+
/* opcode array may be reallocated, so don't access opcode field after zend_emit_op_tmp(). */
3960+
uint8_t opcode = opline->opcode;
39593961

3960-
if (opline->opcode == ZEND_NEW) {
3962+
if (opcode == ZEND_NEW) {
39613963
zend_error_noreturn(E_COMPILE_ERROR, "Cannot create Closure for new expression");
39623964
}
39633965

3964-
if (opline->opcode == ZEND_INIT_FCALL) {
3966+
if (opcode == ZEND_INIT_FCALL) {
39653967
opline->op1.num = zend_vm_calc_used_stack(0, fbc);
39663968
}
39673969

39683970
zend_op *callable_convert_op = zend_emit_op_tmp(result, ZEND_CALLABLE_CONVERT, NULL, NULL);
3969-
if (opline->opcode == ZEND_INIT_FCALL
3970-
|| opline->opcode == ZEND_INIT_FCALL_BY_NAME
3971-
|| opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME) {
3971+
if (opcode == ZEND_INIT_FCALL
3972+
|| opcode == ZEND_INIT_FCALL_BY_NAME
3973+
|| opcode == ZEND_INIT_NS_FCALL_BY_NAME) {
39723974
callable_convert_op->extended_value = zend_alloc_cache_slot();
39733975
} else {
39743976
callable_convert_op->extended_value = (uint32_t)-1;

0 commit comments

Comments
 (0)