Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Mar 2, 2025

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

ndossche added 4 commits March 2, 2025 22:33
The cache slot for FETCH_OBJ_W in function `test` is primed with the
class for C. The next call uses a simplexml instance and reuses the same
cache slot. simplexml's get_property_ptr handler does not use the cache
slot, so the old values remain in the cache slot. When
`zend_handle_fetch_obj_flags` is called this is not guarded by a check
for the class entry. So we end up using the prop_info from the property
C::$a instead of the simplexml property.

This patch adds a reset to the cache slots in the property address fetch
code and also in the extensions with a non-standard reference handler.
This keeps the run time cache consistent and avoids the issue without
complicating the fast paths.

Closes GH-17739.
* PHP-8.3:
  Fix GH-17736: Assertion failure zend_reference_destroy()
* PHP-8.4:
  Fix GH-17736: Assertion failure zend_reference_destroy()
@pull pull bot added the ⤵️ pull label Mar 2, 2025
@pull pull bot merged commit 1ae2c87 into wudi:master Mar 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants