Skip to content

Commit 9ba9b8f

Browse files
committed
Merge branch 'PHP-8.3'
* PHP-8.3: Fix OP1 leak in error path of post inc/dec
2 parents 1226fe0 + ddabe89 commit 9ba9b8f

File tree

3 files changed

+34
-18
lines changed

3 files changed

+34
-18
lines changed

Zend/tests/oss_fuzz_63802.phpt

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
--TEST--
2+
oss-fuzz #63802: OP1 leak in error path of post inc/dec
3+
--FILE--
4+
<?php
5+
class Foo {
6+
public function preInc() {
7+
++$this > 42;
8+
}
9+
public function preDec() {
10+
--$this > 42;
11+
}
12+
public function postInc() {
13+
$this++ > 42;
14+
}
15+
public function postDec() {
16+
$this-- > 42;
17+
}
18+
}
19+
$foo = new Foo();
20+
foreach (['pre', 'post'] as $prePost) {
21+
foreach (['inc', 'dec'] as $incDec) {
22+
try {
23+
$foo->{$prePost . ucfirst($incDec)}();
24+
} catch (TypeError $e) {
25+
echo $e->getMessage(), "\n";
26+
}
27+
}
28+
}
29+
?>
30+
--EXPECT--
31+
Cannot increment Foo
32+
Cannot decrement Foo
33+
Cannot increment Foo
34+
Cannot decrement Foo

Zend/zend_vm_def.h

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1606,9 +1606,6 @@ ZEND_VM_HELPER(zend_post_inc_helper, VAR|CV, ANY)
16061606
ZVAL_COPY(EX_VAR(opline->result.var), var_ptr);
16071607

16081608
increment_function(var_ptr);
1609-
if (UNEXPECTED(EG(exception))) {
1610-
HANDLE_EXCEPTION();
1611-
}
16121609
} while (0);
16131610

16141611
FREE_OP1();
@@ -1657,9 +1654,6 @@ ZEND_VM_HELPER(zend_post_dec_helper, VAR|CV, ANY)
16571654
ZVAL_COPY(EX_VAR(opline->result.var), var_ptr);
16581655

16591656
decrement_function(var_ptr);
1660-
if (UNEXPECTED(EG(exception))) {
1661-
HANDLE_EXCEPTION();
1662-
}
16631657
} while (0);
16641658

16651659
FREE_OP1();

Zend/zend_vm_execute.h

Lines changed: 0 additions & 12 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)