Fix GH-10709: UAF in recursive AST evaluation #10718

iluuu1994 · 2023-02-27T13:13:32Z

Fixes https://oss-fuzz.com/testcase-detail/6445949468934144

Supersedes #10712.

Fixes https://oss-fuzz.com/testcase-detail/6445949468934144

We already have a zend_refcounted here, checking the flags here makes more sense. Set the GC_IMMUTABLE flag on zend_ast_ref values in shm for consistency.

dstogov

I think this is OK.

It's possible to avoid code duplication, by delaying check of zend_ast_evaluate() return value after if (ast_is_refcounted && !GC_DELREF(ast_ref)) { check.

iluuu1994 · 2023-03-06T12:57:31Z

That makes sense, I'll adjust it accordingly before merging. Thanks for the review!

iluuu1994 mentioned this pull request Feb 27, 2023

Fix GH-10709: Recursive class constant evaluation #10712

Closed

iluuu1994 force-pushed the gh-10709-rc branch from 085f4ce to 6d8b72e Compare February 27, 2023 14:19

iluuu1994 requested a review from dstogov February 27, 2023 16:02

dstogov approved these changes Mar 6, 2023

View reviewed changes

iluuu1994 closed this in 7202fe1 Mar 6, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix GH-10709: UAF in recursive AST evaluation #10718

Fix GH-10709: UAF in recursive AST evaluation #10718

iluuu1994 commented Feb 27, 2023

dstogov left a comment

iluuu1994 commented Mar 6, 2023

Fix GH-10709: UAF in recursive AST evaluation #10718

Fix GH-10709: UAF in recursive AST evaluation #10718

Conversation

iluuu1994 commented Feb 27, 2023

dstogov left a comment

Choose a reason for hiding this comment

iluuu1994 commented Mar 6, 2023