Skip to content

Commit ba6bb85

Browse files
committed
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0: Fix use after free
2 parents bb0b4eb + 01702a8 commit ba6bb85

File tree

2 files changed

+25
-2
lines changed

2 files changed

+25
-2
lines changed
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
Use-after-free when resume an already running generator
3+
--FILE--
4+
<?php
5+
function gen(){
6+
$g = yield;
7+
$g->send($y);
8+
}
9+
$gen=gen();
10+
try {
11+
$gen->send($gen);
12+
}catch(y) {
13+
}
14+
?>
15+
--EXPECTF--
16+
Warning: Undefined variable $y in %sresume_running_generator_error_003.php on line 4
17+
18+
Fatal error: Uncaught Error: Cannot resume an already running generator in %sresume_running_generator_error_003.php:4
19+
Stack trace:
20+
#0 %sresume_running_generator_error_003.php(4): Generator->send(NULL)
21+
#1 [internal function]: gen()
22+
#2 %sresume_running_generator_error_003.php(8): Generator->send(Object(Generator))
23+
#3 {main}
24+
thrown in %sresume_running_generator_error_003.php on line 4

Zend/zend_generators.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -919,8 +919,7 @@ ZEND_METHOD(Generator, send)
919919

920920
root = zend_generator_get_current(generator);
921921
/* Put sent value in the target VAR slot, if it is used */
922-
if (root->send_target) {
923-
zval_ptr_dtor(root->send_target);
922+
if (root->send_target && !(root->flags & ZEND_GENERATOR_CURRENTLY_RUNNING)) {
924923
ZVAL_COPY(root->send_target, value);
925924
}
926925

0 commit comments

Comments
 (0)