diff options
-rw-r--r-- | NEWS | 1 | ||||
-rw-r--r-- | Zend/tests/bug79599.phpt | 27 | ||||
-rw-r--r-- | Zend/zend.c | 8 |
3 files changed, 35 insertions, 1 deletions
@@ -3,6 +3,7 @@ PHP NEWS ?? ??? ????, PHP 7.4.7 - Core: + . Fixed bug #97599 (coredump in set_error_handler). (Laruence) . Fixed bug #79566 (Private SHM is not private on Windows). (cmb) . Fixed bug #79489 (.user.ini does not inherit). (cmb) diff --git a/Zend/tests/bug79599.phpt b/Zend/tests/bug79599.phpt new file mode 100644 index 0000000000..da72d1c5b7 --- /dev/null +++ b/Zend/tests/bug79599.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #79599 (coredump in set_error_handler) +--FILE-- +<?php +set_error_handler(function($code, $message){ + throw new \Exception($message); +}); +function test1(){ + $a[] = $b; +} +function test2(){ + $a[$c] = $b; +} +try{ + test1(); +}catch(\Exception $e){ + var_dump($e->getMessage()); +} +try{ + test2(); +}catch(\Exception $e){ + var_dump($e->getMessage()); +} +?> +--EXPECT-- +string(21) "Undefined variable: b" +string(21) "Undefined variable: c" diff --git a/Zend/zend.c b/Zend/zend.c index a9ae03e624..b61658ef53 100644 --- a/Zend/zend.c +++ b/Zend/zend.c @@ -1248,6 +1248,10 @@ ZEND_API zval *zend_get_configuration_directive(zend_string *name) /* {{{ */ } \ } while (0) +static void arg_copy_ctor(zval *zv) { + zval_copy_ctor(zv); +} + static ZEND_COLD void zend_error_va_list( int type, const char *error_filename, uint32_t error_lineno, const char *format, va_list args) @@ -1341,7 +1345,9 @@ static ZEND_COLD void zend_error_va_list( if (!symbol_table) { ZVAL_NULL(¶ms[4]); } else { - ZVAL_ARR(¶ms[4], zend_array_dup(symbol_table)); + array_init(¶ms[4]); + /* always try to do noninvasive duplication */ + zend_hash_copy(Z_ARRVAL(params[4]), symbol_table, arg_copy_ctor); } ZVAL_COPY_VALUE(&orig_user_error_handler, &EG(user_error_handler)); |