Check for null EX(func) in write_property

This can happen if zend_call_function inserted a dummy frame, and we already switched to the dummy frame in leave_helper, and an exception is thrown during CV destruction. Fixes oss-fuzz #25343.
php · Sep 1, 2020 · f92a036 · f92a036
1 parent 3761293
commit f92a036
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 3 deletions.
diff --git a/Zend/tests/ex_func_null_during_property_write.phpt b/Zend/tests/ex_func_null_during_property_write.phpt
@@ -0,0 +1,25 @@
+--TEST--
+EX(func) can be null during write_property in an edge case
+--FILE--
+<?php
+class a {
+    public static $i = 0;
+    function __destruct() {
+        if (self::$i++ != 0) throw new Exception;
+        $b = new a;
+        echo $b;
+    }
+}
+new a;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Object of class a could not be converted to string in %s:%d
+Stack trace:
+#0 %s(%d): a->__destruct()
+#1 {main}
+
+Next Exception in %s:%d
+Stack trace:
+#0 %s(%d): a->__destruct()
+#1 {main}
+  thrown in %s on line %d
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
@@ -809,6 +809,13 @@ ZEND_API zval *zend_std_read_property(zval *object, zval *member, int type, void
 }
 /* }}} */
 
+static zend_always_inline zend_bool property_uses_strict_types() {
+	zend_execute_data *execute_data = EG(current_execute_data);
+	return execute_data
+		&& execute_data->func
+		&& ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data));
+}
+
 ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value, void **cache_slot) /* {{{ */
 {
 	zend_object *zobj;
@@ -833,7 +840,7 @@ ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value,
 
 			if (UNEXPECTED(prop_info)) {
 				ZVAL_COPY_VALUE(&tmp, value);
-				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
+				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
 					Z_TRY_DELREF_P(value);
 					variable_ptr = &EG(error_zval);
 					goto exit;
@@ -842,7 +849,7 @@ ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value,
 			}
 
 found:
-			zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)));
+			zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, property_uses_strict_types());
 			goto exit;
 		}
 		if (Z_PROP_FLAG_P(variable_ptr) == IS_PROP_UNINIT) {
@@ -898,7 +905,7 @@ ZEND_API zval *zend_std_write_property(zval *object, zval *member, zval *value,
 
 			if (UNEXPECTED(prop_info)) {
 				ZVAL_COPY_VALUE(&tmp, value);
-				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
+				if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
 					zval_ptr_dtor(value);
 					goto exit;
 				}