diff options
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/reflection/php_reflection.c | 10 | ||||
| -rw-r--r-- | ext/reflection/tests/bug74673.phpt | 22 |
3 files changed, 34 insertions, 2 deletions
@@ -15,6 +15,10 @@ PHP NEWS . Fixed bug #74663 (Segfault with opcache.memory_protect and validate_timestamp). (Laruence) +- Reflection: + . Fixed bug #74673 (Segfault when cast Reflection object to string with + undefined constant). (Laruence) + - SPL: . Fixed bug #74478 (null coalescing operator failing with SplFixedArray). (jhdxr) diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c index 7d703262f1..5b162f759e 100644 --- a/ext/reflection/php_reflection.c +++ b/ext/reflection/php_reflection.c @@ -462,7 +462,9 @@ static void _class_string(string *str, zend_class_entry *ce, zval *obj, char *in zval *value; ZEND_HASH_FOREACH_STR_KEY_VAL(&ce->constants_table, key, value) { - zval_update_constant_ex(value, 1, NULL); + if (UNEXPECTED(zval_update_constant_ex(value, 1, NULL) == FAILURE)) { + return; + } _const_string(str, ZSTR_VAL(key), value, indent); } ZEND_HASH_FOREACH_END(); } @@ -708,7 +710,11 @@ static void _parameter_string(string *str, zend_function *fptr, struct _zend_arg ZVAL_DUP(&zv, RT_CONSTANT(&fptr->op_array, precv->op2)); old_scope = EG(scope); EG(scope) = fptr->common.scope; - zval_update_constant_ex(&zv, 1, NULL); + if (UNEXPECTED(zval_update_constant_ex(&zv, 1, NULL) == FAILURE)) { + EG(scope) = old_scope; + zval_ptr_dtor(&zv); + return; + } EG(scope) = old_scope; if (Z_TYPE(zv) == IS_TRUE) { string_write(str, "true", sizeof("true")-1); diff --git a/ext/reflection/tests/bug74673.phpt b/ext/reflection/tests/bug74673.phpt new file mode 100644 index 0000000000..8e4e8e3a18 --- /dev/null +++ b/ext/reflection/tests/bug74673.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #74673 (Segfault when cast Reflection object to string with undefined constant) +--FILE-- +<?php + +set_error_handler(function() { + throw new Exception(); +}); + +class A +{ + public function method($test = PHP_SELF + 1) + { + } +} + +$class = new ReflectionClass('A'); + +echo $class; +?> +--EXPECTF-- +Fatal error: Method ReflectionClass::__toString() must not throw an exception, caught Exception: in %sbug74673.php on line %d |