Skip to content

Commit 7e61c2e

Browse files
committed
Fix uninitialized run-time cache when resolving named param defaults
Fixes oss-fuzz #25676.
1 parent 3c53732 commit 7e61c2e

File tree

2 files changed

+21
-0
lines changed

2 files changed

+21
-0
lines changed
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Uninitialized run-time cache when resolving default values
3+
--FILE--
4+
<?php
5+
6+
class Test {
7+
public static function method($a = FOO, $b = 1) {
8+
echo "a = $a, b = $b\n";
9+
}
10+
}
11+
12+
define('FOO', 42);
13+
call_user_func(['Test', 'method'], b: 0);
14+
15+
?>
16+
--EXPECT--
17+
a = 42, b = 0

Zend/zend_execute.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4464,6 +4464,10 @@ ZEND_API zend_result ZEND_FASTCALL zend_handle_undef_args(zend_execute_data *cal
44644464
if (EXPECTED(opline->opcode == ZEND_RECV_INIT)) {
44654465
zval *default_value = RT_CONSTANT(opline, opline->op2);
44664466
if (Z_OPT_TYPE_P(default_value) == IS_CONSTANT_AST) {
4467+
if (UNEXPECTED(!RUN_TIME_CACHE(op_array))) {
4468+
init_func_run_time_cache(op_array);
4469+
}
4470+
44674471
void *run_time_cache = RUN_TIME_CACHE(op_array);
44684472
zval *cache_val =
44694473
(zval *) ((char *) run_time_cache + Z_CACHE_SLOT_P(default_value));

0 commit comments

Comments
 (0)