com php-src: Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:26 0)): NEWS Zend/tests/bug72907.phpt Ze
nd/zend_execute.c Zend/zend_vm_def.h Zend/zend_ vm_execute.h

Commit: b740bb3987ba4f181dfda91ce3bd9fe663155574 Author: Xinchen Hui <laruence@gmail.com> Sun, 21 Aug 2016 17:10:10 +0800 Parents: b12ac316ebbab12d6eb069bc97e560442dc99cd6 Branches: PHP-5.6 PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=b740bb3987ba4f181dfda91ce3bd9fe663155574 Log: Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260)) Bugs: https://bugs.php.net/72907 Changed paths: M NEWS A Zend/tests/bug72907.phpt M Zend/zend_execute.c M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index dca9d4f..608881a 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2016, PHP 5.6.26 +- Core: + . Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer + (zend_gc.c:260)). (Laruence) + - Streams: . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence) diff --git a/Zend/tests/bug72907.phpt b/Zend/tests/bug72907.phpt new file mode 100644 index 0000000..00d9f5d --- /dev/null +++ b/Zend/tests/bug72907.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260)) +--FILE-- +<?php + +$a = 0; + +($a->a = &$E) + ($b = $a->b->i -= 0); + +?> +--EXPECTF-- +Warning: Attempt to modify property of non-object in %sbug72907.php on line %d + +Warning: Attempt to modify property of non-object in %sbug72907.php on line %d + +Warning: Creating default object from empty value in %sbug72907.php on line %d + +Notice: Undefined property: stdClass::$i in %sbug72907.php on line %d diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index c7e4b92..b422624 100644 --- a/Zend/zend_execute..c +++ b/Zend/zend_execute.c @@ -522,9 +522,7 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va zval *variable_ptr = *variable_ptr_ptr; zval *value_ptr = *value_ptr_ptr; - if (variable_ptr == &EG(error_zval) || value_ptr == &EG(error_zval)) { - variable_ptr_ptr = &EG(uninitialized_zval_ptr); - } else if (variable_ptr != value_ptr) { + if (variable_ptr != value_ptr) { if (!PZVAL_IS_REF(value_ptr)) { /* break it away */ Z_DELREF_P(value_ptr); diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 2e81f82..f79d8a3 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -1817,11 +1817,14 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV) if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || (OP1_TYPE == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) { zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects"); - } - zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); - - if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { - Z_DELREF_PP(variable_ptr_ptr); + } else if ((OP2_TYPE == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) || + (OP1_TYPE == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) { + variable_ptr_ptr = &EG(uninitialized_zval_ptr); + } else { + zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); + if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { + Z_DELREF_PP(variable_ptr_ptr); + } } if (RETURN_VALUE_USED(opline)) { diff --git a/Zend/zend_vm_execute..h b/Zend/zend_vm_execute.h index df47bea..a31027e 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -20408,11 +20408,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) { zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects"); - } - zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); - - if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { - Z_DELREF_PP(variable_ptr_ptr); + } else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) || + (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) { + variable_ptr_ptr = &EG(uninitialized_zval_ptr); + } else { + zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); + if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { + Z_DELREF_PP(variable_ptr_ptr); + } } if (RETURN_VALUE_USED(opline)) { @@ -23903,11 +23906,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) { zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects"); - } - zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); - - if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { - Z_DELREF_PP(variable_ptr_ptr); + } else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) || + (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) { + variable_ptr_ptr = &EG(uninitialized_zval_ptr); + } else { + zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); + if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { + Z_DELREF_PP(variable_ptr_ptr); + } } if (RETURN_VALUE_USED(opline)) { @@ -37721,11 +37727,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) { zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects"); - } - zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); - - if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { - Z_DELREF_PP(variable_ptr_ptr); + } else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) || + (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) { + variable_ptr_ptr = &EG(uninitialized_zval_ptr); + } else { + zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); + if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { + Z_DELREF_PP(variable_ptr_ptr); + } } if (RETURN_VALUE_USED(opline)) { @@ -40929,11 +40938,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) { zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects"); - } - zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); - - if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { - Z_DELREF_PP(variable_ptr_ptr); + } else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) || + (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) { + variable_ptr_ptr = &EG(uninitialized_zval_ptr); + } else { + zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC); + if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { + Z_DELREF_PP(variable_ptr_ptr); + } } if (RETURN_VALUE_USED(opline)) {