mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-30 21:35:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix use-after-free with yield from in yield_from_multi_tree_single_nodes.phpt

Browse Source 
Prevent release of generator children during destruction
This commit is contained in:
Bob Weinand 2020-09-14 23:05:28 +02:00
parent f51bbcc2b2
commit 452f7b0d41
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Zend/zend_generators.c
View File

@ -232,7 +232,9 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
child = (zend_generator *) Z_PTR_P(zend_hash_get_current_data(generator->node.child.ht));
}
GC_ADD_FLAGS(&child->std, IS_OBJ_DESTRUCTOR_CALLED);
GC_ADDREF(&child->std); /* must not be released during destructor */
zend_generator_dtor_storage(&child->std);
OBJ_RELEASE(&child->std);
}
}
if (EXPECTED(generator->node.children == 0)) {