Skip to content

Commit 01702a8

Browse files
committed
Fix use after free
Fixes oss-fuzz #44885
1 parent 70f7e7d commit 01702a8

File tree

2 files changed

+25
-2
lines changed

2 files changed

+25
-2
lines changed
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
Use-after-free when resume an already running generator
3+
--FILE--
4+
<?php
5+
function gen(){
6+
$g = yield;
7+
$g->send($y);
8+
}
9+
$gen=gen();
10+
try {
11+
$gen->send($gen);
12+
}catch(y) {
13+
}
14+
?>
15+
--EXPECTF--
16+
Warning: Undefined variable $y in %sresume_running_generator_error_003.php on line 4
17+
18+
Fatal error: Uncaught Error: Cannot resume an already running generator in %sresume_running_generator_error_003.php:4
19+
Stack trace:
20+
#0 %sresume_running_generator_error_003.php(4): Generator->send(NULL)
21+
#1 [internal function]: gen()
22+
#2 %sresume_running_generator_error_003.php(8): Generator->send(Object(Generator))
23+
#3 {main}
24+
thrown in %sresume_running_generator_error_003.php on line 4

Zend/zend_generators.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -923,8 +923,7 @@ ZEND_METHOD(Generator, send)
923923

924924
root = zend_generator_get_current(generator);
925925
/* Put sent value in the target VAR slot, if it is used */
926-
if (root->send_target) {
927-
zval_ptr_dtor(root->send_target);
926+
if (root->send_target && !(root->flags & ZEND_GENERATOR_CURRENTLY_RUNNING)) {
928927
ZVAL_COPY(root->send_target, value);
929928
}
930929

0 commit comments

Comments
 (0)