Skip to content

Fix another use-after-free with static properties/destructors #10546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 9 commits into from

Conversation

iluuu1994
Copy link
Member

Also make expression result of assignments consistent, containing the value of the variable from after the destructor has been executed.

See GH-10168

This will be backported to PHP-8.1 but runs against master CI to prove ASAN passes.

/cc @nielsdos (Can't add you as a reviewer)

@nielsdos
Copy link
Member

nielsdos commented Feb 8, 2023

Right, I had a brief look and I think this makes sense, thanks for handling this

@iluuu1994 iluuu1994 marked this pull request as draft February 9, 2023 00:00
@dstogov
Copy link
Member

dstogov commented Feb 9, 2023

I'll take a look on Moday

@iluuu1994
Copy link
Member Author

Unfortunately, I don't think Zend/tests/gh10168_6.phpt can be solved without adjusting write_property and thus causing a BC break. It would require passing in external storage to store the value in before calling the destructor, as the destructor can change the value of the given property. That could also avoid #10179, at the least.

@iluuu1994
Copy link
Member Author

zend_wrong_assign_to_variable_reference is still missing. Will fix that one tomorrow.

iluuu1994 added a commit that referenced this pull request Feb 10, 2023
@iluuu1994
Copy link
Member Author

Closed in favor of #10606.

@iluuu1994 iluuu1994 closed this Feb 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants