Skip to content

Commit 25ad171

Browse files
committed
JIT: Fixed inaccurate range inference usage for UNDEF/NULL/FALSE
Fixes oss-fuzz #58459
1 parent 8fc023c commit 25ad171

File tree

3 files changed

+25
-2
lines changed

3 files changed

+25
-2
lines changed

ext/opcache/jit/zend_jit_arm64.dasc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4834,7 +4834,7 @@ static int zend_jit_long_math_helper(dasm_State **Dst,
48344834
op2_reg = Z_REG(op2_addr);
48354835
}
48364836

4837-
if (!op2_range || (op2_range->min <= 0 && op2_range->max >= 0)) {
4837+
if ((op2_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) || !op2_range || (op2_range->min <= 0 && op2_range->max >= 0)) {
48384838
| cbz Rx(op2_reg), >1
48394839
|.cold_code
48404840
|1:

ext/opcache/jit/zend_jit_x86.dasc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5272,7 +5272,7 @@ static int zend_jit_long_math_helper(dasm_State **Dst,
52725272
}
52735273
}
52745274
} else {
5275-
if (!op2_range || (op2_range->min <= 0 && op2_range->max >= 0)) {
5275+
if ((op2_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) || !op2_range || (op2_range->min <= 0 && op2_range->max >= 0)) {
52765276
if (Z_MODE(op2_addr) == IS_MEM_ZVAL) {
52775277
| cmp aword [Ra(Z_REG(op2_addr))+Z_OFFSET(op2_addr)], 0
52785278
} else if (Z_MODE(op2_addr) == IS_REG) {

ext/opcache/tests/jit/mod_007.phpt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
JIT MOD: 007
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
opcache.protect_memory=1
9+
--FILE--
10+
<?php
11+
function test($a) {
12+
for(;$a < -2;) {
13+
$n % $n = $a + $a;
14+
}
15+
}
16+
test(null);
17+
?>
18+
--EXPECTF--
19+
Fatal error: Uncaught DivisionByZeroError: Modulo by zero in %smod_007.php:4
20+
Stack trace:
21+
#0 %smod_007.php(7): test(NULL)
22+
#1 {main}
23+
thrown in %smod_007.php on line 4

0 commit comments

Comments
 (0)