mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #61273 (call_user_func_array with more than 16333 arguments leaks / crashes)

Browse Source
This commit is contained in:
Xinchen Hui 2012-03-11 15:28:31 +00:00
parent 49e9d8f351
commit b7ae5e0d86
3 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -8,6 +8,8 @@ PHP NEWS
. "Connection: close" instead of "Connection: closed" (Gustavo)
- Core:
. Fixed bug #61273 (call_user_func_array with more than 16333 arguments
leaks / crashes). (Laruence)
. Fixed bug #61225 (Incorect lexing of 0b00*+<NUM>). (Pierrick)
. Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
. Fixed bug #61106 (Segfault when using header_register_callback). (Nikita

15
Zend/tests/bug61273.phpt Normal file
View File

@ -0,0 +1,15 @@
--TEST--
Bug #61273 (call_user_func_array with more than 16333 arguments leaks / crashes)
--FILE--
<?php
/**
* for 5.3 #define ZEND_VM_STACK_PAGE_SIZE ((64 * 1024) - 64)
* for 5.4 #define ZEND_VM_STACK_PAGE_SIZE ((16 * 1024) - 16)
* we should trick EG(argument_stack) into growing
*/
$args = array_fill(0, 64 * 1024 - 64, "*");
call_user_func_array(function(&$a) {}, $args);
echo strval("okey");
--EXPECTF--
Warning: Parameter 1 to {closure}() expected to be a reference, value given in %sbug61273.php on line %d
okey

2
Zend/zend_execute_API.c
View File

@ -859,7 +859,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
if (fci->no_separation &&
!ARG_MAY_BE_SENT_BY_REF(EX(function_state).function, i + 1)) {
if(i) {
if (i || UNEXPECTED(ZEND_VM_STACK_ELEMETS(EG(argument_stack)) == (EG(argument_stack)->top))) {
/* hack to clean up the stack */
zend_vm_stack_push_nocheck((void *) (zend_uintptr_t)i TSRMLS_CC);
zend_vm_stack_clear_multiple(TSRMLS_C);