Skip to content

Commit efb9181

Browse files
iluuu1994iluuu1994
committed
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1: Revert "Fix phpGH-10168: heap-buffer-overflow at zval_undefined_cv"
2 parents c9ce25c + 7b68ff4 commit efb9181

File tree

8 files changed

+210
-504
lines changed

8 files changed

+210
-504
lines changed

‎NEWS

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ PHP NEWS
1111
Generator emits an unavoidable fatal error or crashes). (Arnaud)
1212
. Fixed bug GH-10437 (Segfault/assertion when using fibers in shutdown
1313
function after bailout). (trowski)
14-
. Fixed bug GH-10168: use-after-free when utilizing assigned object freed
15-
during assignment. (nielsdos)
1614
. Fixed SSA object type update for compound assignment opcodes. (nielsdos)
1715

1816
- Curl:

‎Zend/tests/gh10168_1.phpt

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎Zend/tests/gh10168_2.phpt

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎Zend/tests/gh10168_3.phpt

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎Zend/zend_execute.c

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3525,7 +3525,7 @@ static zend_always_inline void i_zval_ptr_dtor_noref(zval *zval_ptr) {
35253525
}
35263526
}
35273527

3528-
ZEND_API zval* zend_assign_to_typed_ref_and_result(zval *variable_ptr, zval *orig_value, zend_uchar value_type, bool strict, zval *result_variable_ptr)
3528+
ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *orig_value, zend_uchar value_type, bool strict)
35293529
{
35303530
bool ret;
35313531
zval value;
@@ -3545,9 +3545,6 @@ ZEND_API zval* zend_assign_to_typed_ref_and_result(zval *variable_ptr, zval *ori
35453545
} else {
35463546
zval_ptr_dtor_nogc(&value);
35473547
}
3548-
if (result_variable_ptr) {
3549-
ZVAL_COPY(result_variable_ptr, variable_ptr);
3550-
}
35513548
if (value_type & (IS_VAR|IS_TMP_VAR)) {
35523549
if (UNEXPECTED(ref)) {
35533550
if (UNEXPECTED(GC_DELREF(ref) == 0)) {
@@ -3561,11 +3558,6 @@ ZEND_API zval* zend_assign_to_typed_ref_and_result(zval *variable_ptr, zval *ori
35613558
return variable_ptr;
35623559
}
35633560

3564-
ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *orig_value, zend_uchar value_type, bool strict)
3565-
{
3566-
return zend_assign_to_typed_ref_and_result(variable_ptr, orig_value, value_type, strict, NULL);
3567-
}
3568-
35693561
ZEND_API bool ZEND_FASTCALL zend_verify_prop_assignable_by_ref(zend_property_info *prop_info, zval *orig_val, bool strict) {
35703562
zval *val = orig_val;
35713563
if (Z_ISREF_P(val) && ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(val))) {

‎Zend/zend_execute.h

Lines changed: 9 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,6 @@ ZEND_API bool zend_verify_internal_return_type(zend_function *zf, zval *ret);
108108
ZEND_API void ZEND_FASTCALL zend_ref_add_type_source(zend_property_info_source_list *source_list, zend_property_info *prop);
109109
ZEND_API void ZEND_FASTCALL zend_ref_del_type_source(zend_property_info_source_list *source_list, zend_property_info *prop);
110110

111-
ZEND_API zval* zend_assign_to_typed_ref_and_result(zval *variable_ptr, zval *orig_value, zend_uchar value_type, bool strict, zval *result_variable_ptr);
112111
ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *value, zend_uchar value_type, bool strict);
113112

114113
static zend_always_inline void zend_copy_to_variable(zval *variable_ptr, zval *value, zend_uchar value_type)
@@ -138,22 +137,12 @@ static zend_always_inline void zend_copy_to_variable(zval *variable_ptr, zval *v
138137
}
139138
}
140139

141-
static zend_always_inline void zend_handle_garbage_from_variable_assignment(zend_refcounted *garbage)
142-
{
143-
if (GC_DELREF(garbage) == 0) {
144-
rc_dtor_func(garbage);
145-
} else { /* we need to split */
146-
/* optimized version of GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr) */
147-
if (UNEXPECTED(GC_MAY_LEAK(garbage))) {
148-
gc_possible_root(garbage);
149-
}
150-
}
151-
}
152-
153140
static zend_always_inline zval* zend_assign_to_variable(zval *variable_ptr, zval *value, zend_uchar value_type, bool strict)
154141
{
155142
do {
156143
if (UNEXPECTED(Z_REFCOUNTED_P(variable_ptr))) {
144+
zend_refcounted *garbage;
145+
157146
if (Z_ISREF_P(variable_ptr)) {
158147
if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(variable_ptr)))) {
159148
return zend_assign_to_typed_ref(variable_ptr, value, value_type, strict);
@@ -164,42 +153,21 @@ static zend_always_inline zval* zend_assign_to_variable(zval *variable_ptr, zval
164153
break;
165154
}
166155
}
167-
zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
156+
garbage = Z_COUNTED_P(variable_ptr);
168157
zend_copy_to_variable(variable_ptr, value, value_type);
169-
zend_handle_garbage_from_variable_assignment(garbage);
170-
return variable_ptr;
171-
}
172-
} while (0);
173-
174-
zend_copy_to_variable(variable_ptr, value, value_type);
175-
return variable_ptr;
176-
}
177-
178-
static zend_always_inline zval* zend_assign_to_two_variables(zval *result_variable_ptr, zval *variable_ptr, zval *value, zend_uchar value_type, bool strict)
179-
{
180-
do {
181-
if (UNEXPECTED(Z_REFCOUNTED_P(variable_ptr))) {
182-
if (Z_ISREF_P(variable_ptr)) {
183-
if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(variable_ptr)))) {
184-
variable_ptr = zend_assign_to_typed_ref_and_result(variable_ptr, value, value_type, strict, result_variable_ptr);
185-
return variable_ptr;
186-
}
187-
188-
variable_ptr = Z_REFVAL_P(variable_ptr);
189-
if (EXPECTED(!Z_REFCOUNTED_P(variable_ptr))) {
190-
break;
158+
if (GC_DELREF(garbage) == 0) {
159+
rc_dtor_func(garbage);
160+
} else { /* we need to split */
161+
/* optimized version of GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr) */
162+
if (UNEXPECTED(GC_MAY_LEAK(garbage))) {
163+
gc_possible_root(garbage);
191164
}
192165
}
193-
zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
194-
zend_copy_to_variable(variable_ptr, value, value_type);
195-
ZVAL_COPY(result_variable_ptr, variable_ptr);
196-
zend_handle_garbage_from_variable_assignment(garbage);
197166
return variable_ptr;
198167
}
199168
} while (0);
200169

201170
zend_copy_to_variable(variable_ptr, value, value_type);
202-
ZVAL_COPY(result_variable_ptr, variable_ptr);
203171
return variable_ptr;
204172
}
205173

‎Zend/zend_vm_def.h

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2585,9 +2585,6 @@ ZEND_VM_C_LABEL(try_assign_dim_array):
25852585
Z_ADDREF_P(value);
25862586
}
25872587
}
2588-
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2589-
ZVAL_COPY(EX_VAR(opline->result.var), value);
2590-
}
25912588
} else {
25922589
dim = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
25932590
if (OP2_TYPE == IS_CONST) {
@@ -2599,11 +2596,10 @@ ZEND_VM_C_LABEL(try_assign_dim_array):
25992596
ZEND_VM_C_GOTO(assign_dim_error);
26002597
}
26012598
value = GET_OP_DATA_ZVAL_PTR(BP_VAR_R);
2602-
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2603-
zend_assign_to_two_variables(EX_VAR(opline->result.var), variable_ptr, value, OP_DATA_TYPE, EX_USES_STRICT_TYPES());
2604-
} else {
2605-
zend_assign_to_variable(variable_ptr, value, OP_DATA_TYPE, EX_USES_STRICT_TYPES());
2606-
}
2599+
value = zend_assign_to_variable(variable_ptr, value, OP_DATA_TYPE, EX_USES_STRICT_TYPES());
2600+
}
2601+
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2602+
ZVAL_COPY(EX_VAR(opline->result.var), value);
26072603
}
26082604
} else {
26092605
if (EXPECTED(Z_ISREF_P(object_ptr))) {
@@ -2697,14 +2693,12 @@ ZEND_VM_HANDLER(22, ZEND_ASSIGN, VAR|CV, CONST|TMP|VAR|CV, SPEC(RETVAL))
26972693
value = GET_OP2_ZVAL_PTR(BP_VAR_R);
26982694
variable_ptr = GET_OP1_ZVAL_PTR_PTR_UNDEF(BP_VAR_W);
26992695

2700-
if (RETURN_VALUE_USED(opline)) {
2701-
zend_assign_to_two_variables(EX_VAR(opline->result.var), variable_ptr, value, OP2_TYPE, EX_USES_STRICT_TYPES());
2702-
} else {
2703-
zend_assign_to_variable(variable_ptr, value, OP2_TYPE, EX_USES_STRICT_TYPES());
2696+
value = zend_assign_to_variable(variable_ptr, value, OP2_TYPE, EX_USES_STRICT_TYPES());
2697+
if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2698+
ZVAL_COPY(EX_VAR(opline->result.var), value);
27042699
}
2705-
27062700
FREE_OP1();
2707-
/* zend_assign_to_(two_)variable(s)() always takes care of op2, never free it! */
2701+
/* zend_assign_to_variable() always takes care of op2, never free it! */
27082702

27092703
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
27102704
}

0 commit comments

Comments
 (0)