Bug #80240 [NEW]: Use after free multi yield from

From: Date: Thu, 15 Oct 2020 13:09:51 +0000
Subject: Bug #80240 [NEW]: Use after free multi yield from
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-229644@lists.php.net to get a copy of this message 
From:             nikic
Operating system: 
PHP version:      8.0.0rc1
Package:          Scripting Engine problem
Bug Type:         Bug
Bug description:Use after free multi yield from

Description:
------------
@bwoebi came up with this reduction of oss-fuzz #25697 a while ago,
report a bug to make sure it doesn't get lost in a chat log...

Test script:
---------------
<?php

function gen() {
    yield 0;
    yield from gen();
}

function bar($gen) {
    yield from $gen;
}

$gen = gen();
$a = bar($gen);
$b = bar($gen);
$a->rewind();
$b->rewind();
$a->next();
unset($gen);
unset($a);
unset($b);



-- 
Edit bug report at https://bugs.php.net/bug.php?id=80240&edit=1
-- 
Fix committed:                    https://bugs.php.net/fix.php?id=80240&r=fixed
Fixed in release:                 https://bugs.php.net/fix.php?id=80240&r=alreadyfixed
Need backtrace:                   https://bugs.php.net/fix.php?id=80240&r=needtrace
Need Reproduce Script:            https://bugs.php.net/fix.php?id=80240&r=needscript
Try newer version:                https://bugs.php.net/fix.php?id=80240&r=oldversion
Not developer issue:              https://bugs.php.net/fix.php?id=80240&r=support
Expected behavior:                https://bugs.php.net/fix.php?id=80240&r=notwrong
Not enough info:                  https://bugs.php.net/fix.php?id=80240&r=notenoughinfo
Submitted twice:                  https://bugs.php.net/fix.php?id=80240&r=submittedtwice
register_globals:                 https://bugs.php.net/fix.php?id=80240&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80240&r=phptooold
Daylight Savings:                 https://bugs.php.net/fix.php?id=80240&r=dst
IIS Stability:                    https://bugs.php.net/fix.php?id=80240&r=isapi
Install GNU Sed:                  https://bugs.php.net/fix.php?id=80240&r=gnused
Floating point limitations:       https://bugs.php.net/fix.php?id=80240&r=float
No Zend Extensions:               https://bugs.php.net/fix.php?id=80240&r=nozend
MySQL Configuration Error:        https://bugs.php.net/fix.php?id=80240&r=mysqlcfg

Thread (2 messages)

« previous php.bugs (#229644) next »