diff options
| author | Bob Weinand <bobwei9@hotmail.com> | 2020-09-14 23:05:28 +0200 |
|---|---|---|
| committer | Bob Weinand <bobwei9@hotmail.com> | 2020-09-14 23:07:01 +0200 |
| commit | 452f7b0d41c7487dcb523145a2927e1856f7a2dd (patch) | |
| tree | fde418315246fd2e812a2aef4ffcf245392e7aa8 | |
| parent | f51bbcc2b2fd54ce75bf7d554a010c5bb5ea991d (diff) | |
| download | php-git-452f7b0d41c7487dcb523145a2927e1856f7a2dd.tar.gz | |
Fix use-after-free with yield from in yield_from_multi_tree_single_nodes.phpt
Prevent release of generator children during destruction
| -rw-r--r-- | Zend/zend_generators.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c index cbefd531b3..baca12f66b 100644 --- a/Zend/zend_generators.c +++ b/Zend/zend_generators.c @@ -232,7 +232,9 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */ child = (zend_generator *) Z_PTR_P(zend_hash_get_current_data(generator->node.child.ht)); } GC_ADD_FLAGS(&child->std, IS_OBJ_DESTRUCTOR_CALLED); + GC_ADDREF(&child->std); /* must not be released during destructor */ zend_generator_dtor_storage(&child->std); + OBJ_RELEASE(&child->std); } } if (EXPECTED(generator->node.children == 0)) { |