mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed use-after-free introduced by ca49e53670

Browse Source
This commit is contained in:
Dmitry Stogov 2021-04-19 18:16:14 +03:00
parent c8a966a9ae
commit 08dafda123
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
Zend/tests/exception_026.phpt Normal file
View File

@ -0,0 +1,26 @@
--TEST--
Nested exceptions in destructors
--FILE--
<?php
class A {
static $max=0;
function __destruct() {
if (self::$max--<0)
X;
$a = new A;
Y;
}
}
new A;
?>
--EXPECTF--
Fatal error: Uncaught Error: Undefined constant "Y" in %s:8
Stack trace:
#0 %s(11): A->__destruct()
#1 {main}
Next Error: Undefined constant "X" in %s:6
Stack trace:
#0 %s(11): A->__destruct()
#1 {main}
thrown in %s on line 6

5
Zend/zend_objects.c
View File

@ -156,6 +156,11 @@ ZEND_API void zend_objects_destroy_object(zend_object *object)
if (EG(exception) == object) {
zend_error_noreturn(E_CORE_ERROR, "Attempt to destruct pending exception");
} else {
if (EG(current_execute_data)
&& EG(current_execute_data)->func
&& ZEND_USER_CODE(EG(current_execute_data)->func->common.type)) {
zend_rethrow_exception(EG(current_execute_data));
}
old_exception = EG(exception);
old_opline_before_exception = EG(opline_before_exception);
EG(exception) = NULL;