Bug #65821 [Asn->Csd]: By-ref foreach on property access of string offset segfaults
Edit report at https://bugs.php.net/bug.php?id=65821&edit=1
ID: 65821
Updated by: nikic@php.net
Reported by: nikic@php.net
Summary: By-ref foreach on property access of string offset
segfaults
-Status: Assigned
+Status: Closed
Type: Bug
Package: Scripting Engine problem
PHP Version: 5.5.4
Assigned To: nikic
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=536260f2c52af7057a657af96d991acf27c0cc86
Log: Fix bug #65821: By-ref foreach on property access of string offset segfaults
Previous Comments:
------------------------------------------------------------------------
[2013-10-04 10:39:32] dmitry@php.net
Nikita, I think you are right, and ZEND_FETCH_ADD_LOCK may be removed, because now the situation
that it handled resolved by the code at the end of the handler, anyway.
I mean the situation when array might be destroyed right in ZEND_FETCH_OBJ_W handler and
EX_T(opline->result.var).var.ptr_ptr would be incorrect. e.g.
<?php
function foo() {
return array((object)array('x'=>array('a','b','c')));
}
foreach (foo()[0]->x as &$x) {
echo "$x\n";
}
?>
Now it must be handled by:
if (OP1_TYPE == IS_VAR && OP1_FREE && READY_TO_DESTROY(free_op1.var)) {
EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
}
So, your patch looks fine (I hope I didn't miss anything important)
Fell free to commit it into PHP-5.5 and above.
Please, also check if we need to set "opline->extended_value = 1" for
ZEND_FREE/ZEND_SWITCH_FREE opcodes in generate_free_foreach_copy().
I think we don't need it anymore as well.
------------------------------------------------------------------------
[2013-10-02 21:27:52] nikic@php.net
@dmity: Could you please take a look whether the ZEND_FETCH_ADD_LOCK in foreach [1] is still
necessary? I tried removing it [2] and I didn't get any test failures in Zend/ or tests/, so
maybe this is just a leftover?
[1]: http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_compile.c#6237
[2]: https://gist.github.com/nikic/6800754
------------------------------------------------------------------------
[2013-10-02 21:23:54] nikic@php.net
Description:
------------
This segfaults:
$str = "foo";
foreach ($str[0]->bar as &$baz) {}
Because http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_vm_def.h#1391
uses var.ptr_ptr without NULL check (FETCH_OBJ_W with ZEND_FETCH_ADD_LOCK).
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=65821&edit=1
Thread (4 messages)