com php-src: Fix potential crash when setting invalid declare value: Zend/tests/declare_006.phpt Zend/zend_compile.c

Commit: 868930e0794e0ad49a95d6add5e3c7eac8743455 Author: Sara Golemon <pollita@php.net> Wed, 22 Feb 2017 13:56:38 -0800 Parents: 21a05b0418de811340c4c0253a7d2639fc5c1002 Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=868930e0794e0ad49a95d6add5e3c7eac8743455 Log: Fix potential crash when setting invalid declare value Using a non-literal expression in a declare value can cause the compiler to crash trying to turn that AST node into a usable zval. There was an existing test for such values using 'encoding', but that didn't crash because it's handled by the lexer rather than being compiled. Trying to use a non-literal with ticks reproduces the crash. Changed paths: A Zend/tests/declare_006.phpt M Zend/zend_compile.c Diff: diff --git a/Zend/tests/declare_006.phpt b/Zend/tests/declare_006.phpt new file mode 100644 index 0000000..af86c5b --- /dev/null +++ b/Zend/tests/declare_006.phpt @@ -0,0 +1,10 @@ +--TEST-- +Use of non-literals in declare ticks values crashes compiler +--FILE-- +<?php +declare(ticks = UNKNOWN_CONST) { + echo 'Done'; +} +--EXPECTF-- + +Fatal error: declare(ticks) value must be a literal in %sdeclare_006.php on line 2 diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index cbd935a..c4e95c1 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -4366,8 +4366,12 @@ void zend_compile_declare(zend_ast *ast) /* {{{ */ zend_ast *declare_ast = declares->child[i]; zend_ast *name_ast = declare_ast->child[0]; zend_ast *value_ast = declare_ast->child[1]; - zend_string *name = zend_ast_get_str(name_ast); + + if (value_ast->kind != ZEND_AST_ZVAL) { + zend_error_noreturn(E_COMPILE_ERROR, "declare(%s) value must be a literal", ZSTR_VAL(name)); + } + if (zend_string_equals_literal_ci(name, "ticks")) { zval value_zv; zend_const_expr_to_zval(&value_zv, value_ast);