diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2021-02-20 11:16:37 +0100 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2021-02-20 11:16:37 +0100 |
| commit | f37fe68e6300e6a347dffecf8d7788da0ab0a02d (patch) | |
| tree | 038beb8f43def2944420c0639fc2be022c08b22f /Zend/zend_closures.c | |
| parent | 59590663d786f52254a55ffa985fe2fb9b76bbf6 (diff) | |
| download | php-git-f37fe68e6300e6a347dffecf8d7788da0ab0a02d.tar.gz | |
Fix closure GC handler for fake closures
Fixes oss-fuzz #31135.
Diffstat (limited to 'Zend/zend_closures.c')
| -rw-r--r-- | Zend/zend_closures.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c index 2eda4f8f5c..8e5b599e39 100644 --- a/Zend/zend_closures.c +++ b/Zend/zend_closures.c @@ -620,8 +620,9 @@ static HashTable *zend_closure_get_gc(zend_object *obj, zval **table, int *n) /* *table = Z_TYPE(closure->this_ptr) != IS_NULL ? &closure->this_ptr : NULL; *n = Z_TYPE(closure->this_ptr) != IS_NULL ? 1 : 0; - return (closure->func.type == ZEND_USER_FUNCTION && - closure->func.op_array.static_variables) ? + /* Fake closures don't own the static variables they reference. */ + return (closure->func.type == ZEND_USER_FUNCTION + && !(closure->func.op_array.fn_flags & ZEND_ACC_FAKE_CLOSURE)) ? ZEND_MAP_PTR_GET(closure->func.op_array.static_variables_ptr) : NULL; } /* }}} */ |