diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2020-09-15 15:25:22 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-09-15 15:26:41 +0200 |
| commit | 2bbf2a91aacd59d3511b5e22cac064d708140caa (patch) | |
| tree | 3942a0733df479e82a197a1d73bb82d114b32991 /Zend/zend_object_handlers.c | |
| parent | e97aed4ddb75266b52ab5bcc5966c06eed83495f (diff) | |
| download | php-git-2bbf2a91aacd59d3511b5e22cac064d708140caa.tar.gz | |
Fix assumption about property guard hash value
The "member" string here does not necessarily have a pre-calculated
hash value. In particular this is not the case if the class has no
properties.
Fixes oss-fuzz #25546.
Diffstat (limited to 'Zend/zend_object_handlers.c')
| -rw-r--r-- | Zend/zend_object_handlers.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index a0a5e48dee..4dcfadc239 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -619,8 +619,8 @@ ZEND_API uint32_t *zend_get_property_guard(zend_object *zobj, zend_string *membe if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) { zend_string *str = Z_STR_P(zv); if (EXPECTED(str == member) || - /* hash values are always pred-calculated here */ - (EXPECTED(ZSTR_H(str) == ZSTR_H(member)) && + /* "str" always has a pre-calculated hash value here */ + (EXPECTED(ZSTR_H(str) == zend_string_hash_val(member)) && EXPECTED(zend_string_equal_content(str, member)))) { return &Z_PROPERTY_GUARD_P(zv); } else if (EXPECTED(Z_PROPERTY_GUARD_P(zv) == 0)) { |