Fix #79247: Garbage collecting variant objects segfaults

variant objects have no (declared) properties, so the `get_properties`
handlers returns a pointer to constant storage for efficiency reasons.
This pointer must not be returned from the `get_gc` handler, though;
instead we set up an own `get_gc` handler and return NULL from it, to
signal that there are no properties to collect.
This commit is contained in:
Christoph M. Becker 2020-02-08 10:58:15 +01:00
parent 34bab6c9fc
commit b4f61d99cf
3 changed files with 22 additions and 1 deletions

1
NEWS
View File

@ -8,6 +8,7 @@ PHP NEWS
(cmb)
. Fixed bug #79242 (COM error constants don't match com_exception codes on
x86). (cmb)
. Fixed bug #79247 (Garbage collecting variant objects segfaults). (cmb)
- CURL:
. Fixed bug #79019 (Copied cURL handles upload empty file). (cmb)

View File

@ -0,0 +1,13 @@
--TEST--
Bug #79247 (Garbage collecting variant objects segfaults)
--SKIPIF--
<?php
if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
?>
--FILE--
<?php
$keep = new variant(null);
var_dump(gc_collect_cycles());
?>
--EXPECT--
int(0)

View File

@ -243,6 +243,13 @@ static HashTable *com_properties_get(zval *object)
return &zend_empty_array;
}
static HashTable *com_get_gc(zval *object, zval **table, int *n)
{
*table = NULL;
*n = 0;
return NULL;
}
static void function_dtor(zval *zv)
{
zend_internal_function *f = (zend_internal_function*)Z_PTR_P(zv);
@ -573,7 +580,7 @@ zend_object_handlers php_com_object_handlers = {
com_object_count,
NULL, /* get_debug_info */
NULL, /* get_closure */
zend_std_get_gc, /* get_gc */
com_get_gc, /* get_gc */
};
void php_com_object_enable_event_sink(php_com_dotnet_object *obj, int enable)