Fix use-after-free with yield from in yield_from_multi_tree_single_nodes.phpt

bwoebi · bwoebi · commit 452f7b0d41c7 · 2020-09-14T23:07:01.000+02:00
Prevent release of generator children during destruction
diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c
@@ -232,7 +232,9 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 				child = (zend_generator *) Z_PTR_P(zend_hash_get_current_data(generator->node.child.ht));
 			}
 			GC_ADD_FLAGS(&child->std, IS_OBJ_DESTRUCTOR_CALLED);
+			GC_ADDREF(&child->std); /* must not be released during destructor */
 			zend_generator_dtor_storage(&child->std);
+			OBJ_RELEASE(&child->std);
 		}
 	}
 	if (EXPECTED(generator->node.children == 0)) {

Original file line number	Diff line number	Diff line change
`@@ -232,7 +232,9 @@ static void zend_generator_dtor_storage(zend_object object) / {{{ */`
`232`	`232`	`child = (zend_generator *) Z_PTR_P(zend_hash_get_current_data(generator->node.child.ht));`
`233`	`233`	`}`
`234`	`234`	`GC_ADD_FLAGS(&child->std, IS_OBJ_DESTRUCTOR_CALLED);`
	`235`	`+ GC_ADDREF(&child->std); /* must not be released during destructor */`
`235`	`236`	`zend_generator_dtor_storage(&child->std);`
	`237`	`+ OBJ_RELEASE(&child->std);`
`236`	`238`	`}`
`237`	`239`	`}`
`238`	`240`	`if (EXPECTED(generator->node.children == 0)) {`