Skip to content

Fix #69579: Invalid free with extension trait #1262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Fix #69579: Invalid free with extension trait #1262

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f4588c5
Invalid read in zend_function copy with internal function
jbboehr May 5, 2015
c38ced4
ZEND_ACC_ARENA_ALLOCATED flag in add trait method
jbboehr May 6, 2015
b94f521
Code style fix
jbboehr May 6, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion Zend/zend_inheritance.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1121,6 +1121,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, zend_s
function_add_ref(fn);
new_fn = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
memcpy(new_fn, fn, sizeof(zend_op_array));
new_fn->common.fn_flags |= ZEND_ACC_ARENA_ALLOCATED;
fn = zend_hash_update_ptr(&ce->function_table, key, new_fn);
zend_add_magic_methods(ce, key, fn);
}
Expand Down Expand Up @@ -1181,7 +1182,11 @@ static int zend_traits_copy_functions(zend_string *fnname, zend_function *fn, ze

if (exclude_table == NULL || zend_hash_find(exclude_table, fnname) == NULL) {
/* is not in hashtable, thus, function is not to be excluded */
fn_copy = *fn;
if (fn->type == ZEND_INTERNAL_FUNCTION) {
memcpy(&fn_copy, fn, sizeof(zend_internal_function));
} else {
fn_copy = *fn;
}

/* apply aliases which have not alias name, just setting visibility */
if (ce->trait_aliases) {
Expand Down