com php-src: Fixed bug #70124 (null ptr deref / seg fault in ZEND_HANDLE_EXCEPTION): NEWS Zend/tests/bug70 124.phpt Zend/zend_execute.c

Commit: 0f1e87d9c18c52f91cb64267114267d239ad3488 Author: Xinchen Hui <laruence@php.net> Fri, 24 Jul 2015 15:49:01 +0800 Parents: add2b158e2126eb4e0ff85414bb1c7cbe6a56ca8 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=0f1e87d9c18c52f91cb64267114267d239ad3488 Log: Fixed bug #70124 (null ptr deref / seg fault in ZEND_HANDLE_EXCEPTION) Bugs: https://bugs.php.net/70124 Changed paths: M NEWS A Zend/tests/bug70124.phpt M Zend/zend_execute.c Diff: diff --git a/NEWS b/NEWS index 8f57813..66441f7 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,8 @@ PHP NEWS 06 Aug 2015, PHP 7.0.0 Beta 3 - Core: + . Fixed bug #70124 (null ptr deref / seg fault in ZEND_HANDLE_EXCEPTION). + (Laruence) . Fixed bug #70117 (Unexpected return type error). (Laruence) . Fixed bug #70106 (Inheritance by anonymous class). (Bob) diff --git a/Zend/tests/bug70124..phpt b/Zend/tests/bug70124.phpt new file mode 100644 index 0000000..3138430 --- /dev/null +++ b/Zend/tests/bug70124.phpt @@ -0,0 +1,47 @@ +--TEST-- +Bug #70124 (null ptr deref / seg fault in ZEND_HANDLE_EXCEPTION_SPEC_HANDLER) +--FILE-- +<?php + +try { + echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),$f("test"))],chr(48)); +} catch (Error $e) { + var_dump($e->getMessage()); +} + +class A { +} + +try { + echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),a::y("test"))],chr(48)); +} catch (Error $e) { + var_dump($e->getMessage()); +} + +$a = new A; + +try { + echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),$a->y("test"))],chr(48)); +} catch (Error $e) { + var_dump($e->getMessage()); +} + +try { + echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),\bar\y("test"))],chr(48)); +} catch (Error $e) { + var_dump($e->getMessage()); +} + +try { + echo base_convert([array_search(chr(48),chr(48),chr(48),chr(48),chr(48),y("test"))],chr(48)); +} catch (Error $e) { + var_dump($e->getMessage()); +} +?> +--EXPECTF-- +Notice: Undefined variable: f in %sbug70124.php on line %d +string(30) "Function name must be a string" +string(31) "Call to undefined method A::y()" +string(31) "Call to undefined method A::y()" +string(34) "Call to undefined function bar\y()" +string(30) "Call to undefined function y()" diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 2d1bd5e..065809f 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -2395,6 +2395,15 @@ static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data zend_op *opline = EX(func)->op_array.opcodes + op_num; int level; int do_exit; + + if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL || + opline->opcode == ZEND_INIT_FCALL_BY_NAME || + opline->opcode == ZEND_INIT_DYNAMIC_CALL || + opline->opcode == ZEND_INIT_METHOD_CALL || + opline->opcode == ZEND_INIT_STATIC_METHOD_CALL)) { + ZEND_ASSERT(op_num); + opline--; + } do { /* If the exception was thrown during a function call there might be