diff options
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | Zend/tests/bug72767.phpt | 16 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 3 |
3 files changed, 22 insertions, 1 deletions
@@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2016, PHP 7.1.0beta3 +- Core: + . Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator). + (Nikita) + - EXIF: . Fixed bug #72735 (Samsung picture thumb not read (zero size)). (Kalle, Remi) diff --git a/Zend/tests/bug72767.phpt b/Zend/tests/bug72767.phpt new file mode 100644 index 0000000000..20b559b2a1 --- /dev/null +++ b/Zend/tests/bug72767.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #72767: PHP Segfaults when trying to expand an infinite operator +--FILE-- +<?php + +function test() {} +$iterator = new LimitIterator( + new InfiniteIterator(new ArrayIterator([42])), + 0, 17000 +); +test(...$iterator); + +?> +===DONE=== +--EXPECT-- +===DONE=== diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index a81ebba418..a8cb618b74 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -131,7 +131,8 @@ ZEND_API const zend_internal_function zend_pass_function = { ((ZEND_VM_STACK_PAGE_SLOTS(gen) - ZEND_VM_STACK_HEADER_SLOTS) * sizeof(zval)) #define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(gen, size) \ - (((size) + (ZEND_VM_STACK_FREE_PAGE_SIZE(gen) - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE(gen) - 1)) + (((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \ + + (ZEND_VM_STACK_PAGE_SIZE(gen) - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE(gen) - 1)) static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) { zend_vm_stack page = (zend_vm_stack)emalloc(size); |