mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-28 04:14:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #54305 (Crash in gc_remove_zval_from_buffer)

Browse Source
This commit is contained in:
Dmitry Stogov 2011-07-11 10:31:49 +00:00
parent 7d1eef4aa7
commit ac1ae51a38
4 changed files with 73 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -7,6 +7,7 @@ PHP NEWS
- Core
. Fixed bug #54332 (Crash in zend_mm_check_ptr // Heap corruption). (Dmitry)
. Fixed bug #54305 (Crash in gc_remove_zval_from_buffer). (Dmitry)
. Fixed bug #53727 (Inconsistent behavior of is_subclass_of with interfaces)
(Ralph Schindler, Dmitry)
. Fixed buffer overflow on overlog salt in crypt(). (Clément LECIGNE, Stas)

22
Zend/tests/bug54305.phpt Normal file
View File

@ -0,0 +1,22 @@
--TEST--
Bug #54305 (Crash in gc_remove_zval_from_buffer)
--FILE--
<?php
class TestClass {
public function methodWithArgs($a, $b) {
}
}
abstract class AbstractClass {
}
$methodWithArgs = new ReflectionMethod('TestClass', 'methodWithArgs');
echo $methodWithArgs++;
?>
--EXPECTF--
Method [ <user> public method methodWithArgs ] {
@@ %sbug54305.php %d - %d
- Parameters [2] {
Parameter #0 [ <required> $a ]
Parameter #1 [ <required> $b ]
}
}

14
Zend/zend_vm_def.h
View File

@ -900,10 +900,16 @@ ZEND_VM_HANDLER(40, ZEND_ECHO, CONST|TMP|VAR|CV, ANY)
zval *z = GET_OP1_ZVAL_PTR(BP_VAR_R);
if (OP1_TYPE != IS_CONST &&
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) {
if (OP1_TYPE == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}

56
Zend/zend_vm_execute.h
View File

@ -1324,10 +1324,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
zval *z = &opline->op1.u.constant;
if (IS_CONST != IS_CONST &&
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_CONST == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}
@ -4614,10 +4620,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
zval *z = _get_zval_ptr_tmp(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
if (IS_TMP_VAR != IS_CONST &&
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_TMP_VAR == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}
@ -7870,10 +7882,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
zval *z = _get_zval_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
if (IS_VAR != IS_CONST &&
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_VAR == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}
@ -21767,10 +21785,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
zval *z = _get_zval_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC);
if (IS_CV != IS_CONST &&
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_CV == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}