Skip to content

Commit 0fa78a5

Browse files
SammyKSammyK
committed
Use retval by ref before it is freed
1 parent 95f943a commit 0fa78a5

File tree

2 files changed

+35
-2
lines changed

2 files changed

+35
-2
lines changed

‎Zend/zend_vm_def.h

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4333,17 +4333,20 @@ ZEND_VM_COLD_CONST_HANDLER(111, ZEND_RETURN_BY_REF, CONST|TMP|VAR|CV, ANY, SRC,
43334333

43344334
retval_ptr = GET_OP1_ZVAL_PTR(BP_VAR_R);
43354335
if (!EX(return_value)) {
4336+
ZEND_OBSERVER_FCALL_END(execute_data, retval_ptr);
43364337
FREE_OP1();
43374338
} else {
43384339
if (OP1_TYPE == IS_VAR && UNEXPECTED(Z_ISREF_P(retval_ptr))) {
43394340
ZVAL_COPY_VALUE(EX(return_value), retval_ptr);
4341+
ZEND_OBSERVER_FCALL_END(execute_data, retval_ptr);
43404342
break;
43414343
}
43424344

43434345
ZVAL_NEW_REF(EX(return_value), retval_ptr);
43444346
if (OP1_TYPE == IS_CONST) {
43454347
Z_TRY_ADDREF_P(retval_ptr);
43464348
}
4349+
ZEND_OBSERVER_FCALL_END(execute_data, retval_ptr);
43474350
}
43484351
break;
43494352
}
@@ -4356,7 +4359,9 @@ ZEND_VM_COLD_CONST_HANDLER(111, ZEND_RETURN_BY_REF, CONST|TMP|VAR|CV, ANY, SRC,
43564359
zend_error(E_NOTICE, "Only variable references should be returned by reference");
43574360
if (EX(return_value)) {
43584361
ZVAL_NEW_REF(EX(return_value), retval_ptr);
4362+
ZEND_OBSERVER_FCALL_END(execute_data, retval_ptr);
43594363
} else {
4364+
ZEND_OBSERVER_FCALL_END(execute_data, retval_ptr);
43604365
FREE_OP1_VAR_PTR();
43614366
}
43624367
break;
@@ -4372,10 +4377,10 @@ ZEND_VM_COLD_CONST_HANDLER(111, ZEND_RETURN_BY_REF, CONST|TMP|VAR|CV, ANY, SRC,
43724377
ZVAL_REF(EX(return_value), Z_REF_P(retval_ptr));
43734378
}
43744379

4380+
ZEND_OBSERVER_FCALL_END(execute_data, retval_ptr);
43754381
FREE_OP1_VAR_PTR();
43764382
} while (0);
43774383

4378-
ZEND_OBSERVER_FCALL_END(execute_data, retval_ptr);
43794384
ZEND_VM_DISPATCH_TO_HELPER(zend_leave_helper);
43804385
}
43814386

‎Zend/zend_vm_execute.h

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4197,16 +4197,19 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPE
41974197
retval_ptr = RT_CONSTANT(opline, opline->op1);
41984198
if (!EX(return_value)) {
41994199

4200+
42004201
} else {
42014202
if (IS_CONST == IS_VAR && UNEXPECTED(Z_ISREF_P(retval_ptr))) {
42024203
ZVAL_COPY_VALUE(EX(return_value), retval_ptr);
4204+
42034205
break;
42044206
}
42054207

42064208
ZVAL_NEW_REF(EX(return_value), retval_ptr);
42074209
if (IS_CONST == IS_CONST) {
42084210
Z_TRY_ADDREF_P(retval_ptr);
42094211
}
4212+
42104213
}
42114214
break;
42124215
}
@@ -4219,8 +4222,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPE
42194222
zend_error(E_NOTICE, "Only variable references should be returned by reference");
42204223
if (EX(return_value)) {
42214224
ZVAL_NEW_REF(EX(return_value), retval_ptr);
4225+
42224226
} else {
42234227

4228+
42244229
}
42254230
break;
42264231
}
@@ -4235,6 +4240,7 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPE
42354240
ZVAL_REF(EX(return_value), Z_REF_P(retval_ptr));
42364241
}
42374242

4243+
42384244
} while (0);
42394245

42404246
ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
@@ -4255,17 +4261,20 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPE
42554261

42564262
retval_ptr = get_zval_ptr(opline->op1_type, opline->op1, BP_VAR_R);
42574263
if (!EX(return_value)) {
4264+
zend_observer_fcall_end(execute_data, retval_ptr);
42584265
FREE_OP(opline->op1_type, opline->op1.var);
42594266
} else {
42604267
if (opline->op1_type == IS_VAR && UNEXPECTED(Z_ISREF_P(retval_ptr))) {
42614268
ZVAL_COPY_VALUE(EX(return_value), retval_ptr);
4269+
zend_observer_fcall_end(execute_data, retval_ptr);
42624270
break;
42634271
}
42644272

42654273
ZVAL_NEW_REF(EX(return_value), retval_ptr);
42664274
if (opline->op1_type == IS_CONST) {
42674275
Z_TRY_ADDREF_P(retval_ptr);
42684276
}
4277+
zend_observer_fcall_end(execute_data, retval_ptr);
42694278
}
42704279
break;
42714280
}
@@ -4278,7 +4287,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPE
42784287
zend_error(E_NOTICE, "Only variable references should be returned by reference");
42794288
if (EX(return_value)) {
42804289
ZVAL_NEW_REF(EX(return_value), retval_ptr);
4290+
zend_observer_fcall_end(execute_data, retval_ptr);
42814291
} else {
4292+
zend_observer_fcall_end(execute_data, retval_ptr);
42824293
if (opline->op1_type == IS_VAR) {zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));};
42834294
}
42844295
break;
@@ -4294,10 +4305,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPE
42944305
ZVAL_REF(EX(return_value), Z_REF_P(retval_ptr));
42954306
}
42964307

4308+
zend_observer_fcall_end(execute_data, retval_ptr);
42974309
if (opline->op1_type == IS_VAR) {zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));};
42984310
} while (0);
42994311

4300-
zend_observer_fcall_end(execute_data, retval_ptr);
43014312
ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
43024313
}
43034314

@@ -18639,17 +18650,20 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER
1863918650

1864018651
retval_ptr = _get_zval_ptr_tmp(opline->op1.var EXECUTE_DATA_CC);
1864118652
if (!EX(return_value)) {
18653+
1864218654
zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));
1864318655
} else {
1864418656
if (IS_TMP_VAR == IS_VAR && UNEXPECTED(Z_ISREF_P(retval_ptr))) {
1864518657
ZVAL_COPY_VALUE(EX(return_value), retval_ptr);
18658+
1864618659
break;
1864718660
}
1864818661

1864918662
ZVAL_NEW_REF(EX(return_value), retval_ptr);
1865018663
if (IS_TMP_VAR == IS_CONST) {
1865118664
Z_TRY_ADDREF_P(retval_ptr);
1865218665
}
18666+
1865318667
}
1865418668
break;
1865518669
}
@@ -18662,8 +18676,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER
1866218676
zend_error(E_NOTICE, "Only variable references should be returned by reference");
1866318677
if (EX(return_value)) {
1866418678
ZVAL_NEW_REF(EX(return_value), retval_ptr);
18679+
1866518680
} else {
1866618681

18682+
1866718683
}
1866818684
break;
1866918685
}
@@ -18678,6 +18694,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_TMP_HANDLER
1867818694
ZVAL_REF(EX(return_value), Z_REF_P(retval_ptr));
1867918695
}
1868018696

18697+
1868118698
} while (0);
1868218699

1868318700
ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
@@ -21215,17 +21232,20 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER
2121521232

2121621233
retval_ptr = _get_zval_ptr_var(opline->op1.var EXECUTE_DATA_CC);
2121721234
if (!EX(return_value)) {
21235+
2121821236
zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));
2121921237
} else {
2122021238
if (IS_VAR == IS_VAR && UNEXPECTED(Z_ISREF_P(retval_ptr))) {
2122121239
ZVAL_COPY_VALUE(EX(return_value), retval_ptr);
21240+
2122221241
break;
2122321242
}
2122421243

2122521244
ZVAL_NEW_REF(EX(return_value), retval_ptr);
2122621245
if (IS_VAR == IS_CONST) {
2122721246
Z_TRY_ADDREF_P(retval_ptr);
2122821247
}
21248+
2122921249
}
2123021250
break;
2123121251
}
@@ -21238,7 +21258,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER
2123821258
zend_error(E_NOTICE, "Only variable references should be returned by reference");
2123921259
if (EX(return_value)) {
2124021260
ZVAL_NEW_REF(EX(return_value), retval_ptr);
21261+
2124121262
} else {
21263+
2124221264
zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));
2124321265
}
2124421266
break;
@@ -37758,16 +37780,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_CV_HANDLER(
3775837780
retval_ptr = _get_zval_ptr_cv_BP_VAR_R(opline->op1.var EXECUTE_DATA_CC);
3775937781
if (!EX(return_value)) {
3776037782

37783+
3776137784
} else {
3776237785
if (IS_CV == IS_VAR && UNEXPECTED(Z_ISREF_P(retval_ptr))) {
3776337786
ZVAL_COPY_VALUE(EX(return_value), retval_ptr);
37787+
3776437788
break;
3776537789
}
3776637790

3776737791
ZVAL_NEW_REF(EX(return_value), retval_ptr);
3776837792
if (IS_CV == IS_CONST) {
3776937793
Z_TRY_ADDREF_P(retval_ptr);
3777037794
}
37795+
3777137796
}
3777237797
break;
3777337798
}
@@ -37780,8 +37805,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_CV_HANDLER(
3778037805
zend_error(E_NOTICE, "Only variable references should be returned by reference");
3778137806
if (EX(return_value)) {
3778237807
ZVAL_NEW_REF(EX(return_value), retval_ptr);
37808+
3778337809
} else {
3778437810

37811+
3778537812
}
3778637813
break;
3778737814
}
@@ -37796,6 +37823,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RETURN_BY_REF_SPEC_CV_HANDLER(
3779637823
ZVAL_REF(EX(return_value), Z_REF_P(retval_ptr));
3779737824
}
3779837825

37826+
3779937827
} while (0);
3780037828

3780137829
ZEND_VM_TAIL_CALL(zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));

0 commit comments

Comments
 (0)