diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-10-04 10:39:32 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-10-04 10:39:32 +0200 |
| commit | 11d139625f328873a348cc11df21bdb59bbeaba4 (patch) | |
| tree | 33795ea6d83c4bdc5bff50cda5b8388e33fbf00a | |
| parent | c10cd739a75d830137bff66561a2e87fe21882a3 (diff) | |
| parent | 9659562cb5422099cc1286263e0ef883dab4d647 (diff) | |
| download | php-git-11d139625f328873a348cc11df21bdb59bbeaba4.tar.gz | |
Merge branch 'PHP-7.4'
| -rw-r--r-- | Zend/tests/assign_coalesce_006.phpt | 12 | ||||
| -rw-r--r-- | Zend/zend_compile.c | 9 |
2 files changed, 20 insertions, 1 deletions
diff --git a/Zend/tests/assign_coalesce_006.phpt b/Zend/tests/assign_coalesce_006.phpt new file mode 100644 index 0000000000..dfe43b3c29 --- /dev/null +++ b/Zend/tests/assign_coalesce_006.phpt @@ -0,0 +1,12 @@ +--TEST-- +Null coalesce assign with memoized constant operand that is later interned (OSS-Fuzz #17903) +--FILE-- +<?php +$foo[__DIR__] ??= 42; +var_dump($foo); +?> +--EXPECTF-- +array(1) { + ["%s"]=> + int(42) +} diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 27113fa2b6..eeeadb9d18 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -2100,6 +2100,9 @@ static void zend_compile_memoized_expr(znode *result, zend_ast *expr) /* {{{ */ } else if (result->op_type == IS_TMP_VAR) { zend_emit_op_tmp(&memoized_result, ZEND_COPY_TMP, result, NULL); } else { + if (result->op_type == IS_CONST) { + Z_TRY_ADDREF(result->u.constant); + } memoized_result = *result; } @@ -7433,7 +7436,11 @@ void zend_compile_coalesce(znode *result, zend_ast *ast) /* {{{ */ /* }}} */ static void znode_dtor(zval *zv) { - efree(Z_PTR_P(zv)); + znode *node = Z_PTR_P(zv); + if (node->op_type == IS_CONST) { + zval_ptr_dtor_nogc(&node->u.constant); + } + efree(node); } void zend_compile_assign_coalesce(znode *result, zend_ast *ast) /* {{{ */ |