mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-27 20:03:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.0' into PHP-8.1

Browse Source 
* PHP-8.0:
  Fix use after free
This commit is contained in:
Dmitry Stogov 2022-06-14 12:45:12 +03:00
commit 6797f338a7
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ext/standard/tests/streams/user_streams_context_001.phpt Normal file
View File

@ -0,0 +1,15 @@
--TEST--
User streams and incrrectly typed context
--FILE--
<?php
class Wrapper {
public Foo $context;
}
if (stream_wrapper_register('foo', Wrapper::class)) dir('foo://');
?>
--EXPECTF--
Fatal error: Uncaught TypeError: Cannot assign resource to property Wrapper::$context of type Foo in %suser_streams_context_001.php:5
Stack trace:
#0 %suser_streams_context_001.php(5): dir('foo://')
#1 {main}
thrown in %suser_streams_context_001.php on line 5

2
main/streams/userspace.c
View File

@ -289,8 +289,8 @@ static void user_stream_create_object(struct php_user_stream_wrapper *uwrap, php
}
if (context) {
add_property_resource(object, "context", context->res);
GC_ADDREF(context->res);
add_property_resource(object, "context", context->res);
} else {
add_property_null(object, "context");
}