Skip to content

Commit 68e602f

Browse files
jbboehrnikic
authored andcommitted
Fix bug #69579
1 parent adaf68c commit 68e602f

File tree

7 files changed

+56
-9
lines changed

7 files changed

+56
-9
lines changed

NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ PHP NEWS
1010
. Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
1111
password_verify). (Anatol)
1212
. Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
13+
. Fixed bug #69579 (Invalid free in extension trait). (John Boehr)
1314

1415
- COM:
1516
. Fixed bug #73126 (Cannot pass parameter 1 by reference). (Anatol)

Zend/tests/traits/bug69579.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
Bug #69579 (Internal trait double-free)
3+
--SKIPIF--
4+
<?php
5+
if (!PHP_DEBUG) die("skip only run in debug version");
6+
?>
7+
--FILE--
8+
<?php
9+
10+
class Bar{
11+
use _ZendTestTrait;
12+
}
13+
14+
$bar = new Bar();
15+
var_dump($bar->testMethod());
16+
// destruction causes a double-free and explodes
17+
18+
?>
19+
--EXPECT--
20+
bool(true)

Zend/tests/traits/get_declared_traits_001.phpt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ final class e { }
1212
var_dump(get_declared_traits());
1313

1414
?>
15-
--EXPECT--
16-
array(1) {
17-
[0]=>
15+
--EXPECTF--
16+
array(%d) {%A
17+
[%d]=>
1818
string(1) "c"
1919
}

Zend/tests/traits/get_declared_traits_002.phpt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ namespace test {
1313
}
1414

1515
?>
16-
--EXPECT--
17-
array(1) {
18-
[0]=>
16+
--EXPECTF--
17+
array(%d) {%A
18+
[%d]=>
1919
string(6) "test\c"
2020
}

Zend/tests/traits/get_declared_traits_003.phpt

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,15 @@ var_dump(get_declared_traits());
1313

1414
?>
1515
--EXPECTF--
16-
%astring(1) "a"
16+
array(%d) {%A
17+
[%d]=>
18+
string(1) "a"
1719
[%d]=>
1820
string(1) "d"
1921
[%d]=>
2022
string(1) "e"
2123
}
22-
array(1) {
23-
[0]=>
24+
array(%d) {%A
25+
[%d]=>
2426
string(1) "c"
2527
}

Zend/zend_builtin_functions.c

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@
3131

3232
#undef ZEND_TEST_EXCEPTIONS
3333

34+
#if ZEND_DEBUG
35+
static zend_class_entry *zend_test_trait;
36+
#endif
37+
3438
static ZEND_FUNCTION(zend_version);
3539
static ZEND_FUNCTION(func_num_args);
3640
static ZEND_FUNCTION(func_get_arg);
@@ -257,6 +261,18 @@ ZEND_END_ARG_INFO()
257261

258262
/* }}} */
259263

264+
#if ZEND_DEBUG
265+
static ZEND_METHOD(_ZendTestTrait, testMethod) /* {{{ */ {
266+
RETURN_TRUE;
267+
}
268+
/* }}} */
269+
270+
static zend_function_entry zend_test_trait_methods[] = {
271+
ZEND_ME(_ZendTestTrait, testMethod, arginfo_zend__void, ZEND_ACC_PUBLIC)
272+
ZEND_FE_END
273+
};
274+
#endif
275+
260276
static const zend_function_entry builtin_functions[] = { /* {{{ */
261277
ZEND_FE(zend_version, arginfo_zend__void)
262278
ZEND_FE(func_num_args, arginfo_zend__void)
@@ -339,6 +355,13 @@ ZEND_MINIT_FUNCTION(core) { /* {{{ */
339355

340356
zend_register_default_classes();
341357

358+
#if ZEND_DEBUG
359+
INIT_CLASS_ENTRY(class_entry, "_ZendTestTrait", zend_test_trait_methods);
360+
zend_test_trait = zend_register_internal_class(&class_entry);
361+
zend_test_trait->ce_flags |= ZEND_ACC_TRAIT;
362+
zend_declare_property_null(zend_test_trait, "testProp", sizeof("testProp")-1, ZEND_ACC_PUBLIC);
363+
#endif
364+
342365
return SUCCESS;
343366
}
344367
/* }}} */

Zend/zend_inheritance.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1180,6 +1180,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, zend_s
11801180
function_add_ref(fn);
11811181
new_fn = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
11821182
memcpy(new_fn, fn, sizeof(zend_op_array));
1183+
new_fn->common.fn_flags |= ZEND_ACC_ARENA_ALLOCATED;
11831184
fn = zend_hash_update_ptr(&ce->function_table, key, new_fn);
11841185
zend_add_magic_methods(ce, key, fn);
11851186
}

0 commit comments

Comments
 (0)