Skip to content

Commit 543c168

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix OSS-Fuzz #371445205: Heap-use-after-free in attr_free
2 parents 6e172f0 + e0b1b69 commit 543c168

File tree

2 files changed

+17
-1
lines changed

2 files changed

+17
-1
lines changed
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
OSS-Fuzz #371445205 (Heap-use-after-free in attr_free)
3+
--FILE--
4+
<?php
5+
#[Attribute]
6+
class MyAttrib{}
7+
#[MyAttrib(notinterned:'')]
8+
class Test1{}
9+
$attr=(new ReflectionClass(Test1::class))->getAttributes()[0];
10+
try {
11+
$attr->newInstance();
12+
} catch (Error $e) {
13+
echo $e->getMessage(), "\n";
14+
}
15+
?>
16+
--EXPECT--
17+
Unknown named parameter $notinterned

Zend/zend_API.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1879,7 +1879,6 @@ ZEND_API zend_result object_init_with_constructor(zval *arg, zend_class_entry *c
18791879
zend_hash_get_current_key(named_params, &arg_name, /* num_index */ NULL);
18801880
ZEND_ASSERT(arg_name != NULL);
18811881
zend_throw_error(NULL, "Unknown named parameter $%s", ZSTR_VAL(arg_name));
1882-
zend_string_release(arg_name);
18831882
/* Do not call destructor, free object, and set arg to IS_UNDEF */
18841883
zend_object_store_ctor_failed(obj);
18851884
zval_ptr_dtor(arg);

0 commit comments

Comments
 (0)