diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-08-24 11:47:31 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-08-24 14:08:32 +0200 |
| commit | 6b6c2c003c69729832a7804c76bff6e230b73c91 (patch) | |
| tree | 73d429b85b0f0932c6e7ef163d97a1131f8821b5 /Zend/zend_vm_def.h | |
| parent | 5ab7b30cd6fa6973197e660ca7a86df686558562 (diff) | |
| download | php-git-6b6c2c003c69729832a7804c76bff6e230b73c91.tar.gz | |
Fix #79979: passing value to by-ref param via CUFA crashes
If a by-val send is not allowed, we must not do so. Instead we wrap
the value in a temporary reference.
Closes GH-6000
Diffstat (limited to 'Zend/zend_vm_def.h')
| -rw-r--r-- | Zend/zend_vm_def.h | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index a5a2070b43..fa70bf9f96 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -5128,6 +5128,7 @@ ZEND_VM_C_LABEL(send_array): arg_num = 1; param = ZEND_CALL_ARG(EX(call), 1); ZEND_HASH_FOREACH_VAL(ht, arg) { + zend_bool must_wrap = 0; if (skip > 0) { skip--; continue; @@ -5139,6 +5140,7 @@ ZEND_VM_C_LABEL(send_array): /* By-value send is not allowed -- emit a warning, * but still perform the call. */ zend_param_must_be_ref(EX(call)->func, arg_num); + must_wrap = 1; } } } else { @@ -5148,7 +5150,11 @@ ZEND_VM_C_LABEL(send_array): arg = Z_REFVAL_P(arg); } } - ZVAL_COPY(param, arg); + if (EXPECTED(!must_wrap)) { + ZVAL_COPY(param, arg); + } else { + ZVAL_NEW_REF(param, arg); + } ZEND_CALL_NUM_ARGS(EX(call))++; arg_num++; param++; @@ -5160,12 +5166,14 @@ ZEND_VM_C_LABEL(send_array): arg_num = 1; param = ZEND_CALL_ARG(EX(call), 1); ZEND_HASH_FOREACH_VAL(ht, arg) { + zend_bool must_wrap = 0; if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) { if (UNEXPECTED(!Z_ISREF_P(arg))) { if (!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, arg_num)) { /* By-value send is not allowed -- emit a warning, * but still perform the call. */ zend_param_must_be_ref(EX(call)->func, arg_num); + must_wrap = 1; } } } else { @@ -5175,7 +5183,11 @@ ZEND_VM_C_LABEL(send_array): arg = Z_REFVAL_P(arg); } } - ZVAL_COPY(param, arg); + if (EXPECTED(!must_wrap)) { + ZVAL_COPY(param, arg); + } else { + ZVAL_NEW_REF(param, arg); + } ZEND_CALL_NUM_ARGS(EX(call))++; arg_num++; param++; |