com php-src: Fixed rarely possible use-after-free: ext/opcache/ Optimizer/zend_optimizer.c

Commit: b6e34eaf04c5fc692f7c1aff77647f4961c99748 Author: Dmitry Stogov <dmitry@zend.com> Wed, 4 Oct 2017 16:38:55 +0300 Parents: c935b832dc5134ba37752af1049f4e730f5e0400 Branches: PHP-7.1 PHP-7.2 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=b6e34eaf04c5fc692f7c1aff77647f4961c99748 Log: Fixed rarely possible use-after-free Changed paths: M ext/opcache/Optimizer/zend_optimizer.c Diff: diff --git a/ext/opcache/Optimizer/zend_optimizer.c b/ext/opcache/Optimizer/zend_optimizer.c index 08ac084..c5f62b3 100644 --- a/ext/opcache/Optimizer/zend_optimizer.c +++ b/ext/opcache/Optimizer/zend_optimizer.c @@ -1027,6 +1027,19 @@ int zend_optimize_script(zend_script *script, zend_long optimization_level, zend ZEND_SET_FUNC_INFO(call_graph.op_arrays[i], NULL); } + ZEND_HASH_FOREACH_PTR(&script->class_table, ce) { + ZEND_HASH_FOREACH_STR_KEY_PTR(&ce->function_table, name, op_array) { + if (op_array->scope != ce) { + zend_op_array *orig_op_array; + if ((orig_op_array = zend_hash_find_ptr(&op_array->scope->function_table, name)) != NULL) { + HashTable *ht = op_array->static_variables; + *op_array = *orig_op_array; + op_array->static_variables = ht; + } + } + } ZEND_HASH_FOREACH_END(); + } ZEND_HASH_FOREACH_END(); + zend_arena_release(&ctx.arena, checkpoint); } else #endif