bdnugget/php-src
1
0 Fork 0
mirror of https://github.com/bdnugget/php-src.git synced 2026-11-07 09:17:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix trampoline leak on dynamic static call of non-static method

Browse Source 
Fixes oss-fuzz #30317.
This commit is contained in:
Nikita Popov committed 2021-02-22 10:32:59 +01:00
1 parent ed4f90f0c7
commit ab98944195
2 files changed
+38
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Zend/tests/dynamic_call_non_static.phpt
+30
View File
@@ -0,0 +1,30 @@
--TEST--
Dynamic static call of non-static method
--FILE--
<?php
class Foo {
function test1() {
$method = ['Foo', 'bar'];
$method();
}
function test2() {
$method = 'Foo::bar';
$method();
}
function __call($name, $args) {}
}
$x = new Foo;
try {
$x->test1();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
try {
$x->test2();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
Non-static method Foo::bar() cannot be called statically
Non-static method Foo::bar() cannot be called statically
Zend/zend_execute.c
+8
View File
@@ -4005,6 +4005,10 @@ static zend_never_inline zend_execute_data *zend_init_dynamic_call_string(zend_s
if (UNEXPECTED(!(fbc->common.fn_flags & ZEND_ACC_STATIC))) {
zend_non_static_method_call(fbc);
if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
zend_string_release_ex(fbc->common.function_name, 0);
zend_free_trampoline(fbc);
}
return NULL;
}
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
@@ -4129,6 +4133,10 @@ static zend_never_inline zend_execute_data *zend_init_dynamic_call_array(zend_ar
}
if (!(fbc->common.fn_flags & ZEND_ACC_STATIC)) {
zend_non_static_method_call(fbc);
if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
zend_string_release_ex(fbc->common.function_name, 0);
zend_free_trampoline(fbc);
}
return NULL;
}
object_or_called_scope = called_scope;