[php-src] PR #25278: Fix GH-24430: Check for user frame before reading opline in generator dtor
| From: | prateekbhujel | Date: | Sat, 07 Nov 2026 11:05:54 +0000 |
| Subject: | [php-src] PR #25278: Fix GH-24430: Check for user frame before reading opline in generator dtor | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40385@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25278
Author: prateekbhujel
Fixes GH-24430
When
zend_generator_dtor_storage() executes a generator's finally
block while EG(exception) is already set (for example, when an earlier generator's
finally block threw during gc_collect_cycles() inside a fiber),
EG(current_execute_data) is the gc_destructor_fiber() internal function
frame.
Because zend_vm_init_call_frame() does not initialize call->opline for
internal function frames, EG(current_execute_data)->opline contains uninitialized
stack memory when the fiber VM stack page is allocated from dirty heap memory or under
AddressSanitizer. Reading EG(current_execute_data)->opline->opcode without first
checking EG(current_execute_data)->func &&
ZEND_USER_CODE(EG(current_execute_data)->func->common.type) then dereferences an
uninitialized pointer.
Guard the opline check with EG(current_execute_data)->func &&
ZEND_USER_CODE(EG(current_execute_data)->func->common.type), matching
is_handle_exception_set() in Zend/zend_exceptions.c.
cc @alexandre-daubois @iluuu1994