Prevent usage of uninitialized class entry

dstogov · dstogov · commit 2224f63bb5eb · 2020-05-12T23:34:07.000+03:00
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
@@ -2180,12 +2180,13 @@ static uint32_t zend_convert_type_declaration_mask(uint32_t type_mask) {
 uint32_t zend_fetch_arg_info_type(const zend_script *script, zend_arg_info *arg_info, zend_class_entry **pce)
 {
 	uint32_t tmp;
+
+	*pce = NULL;
 	if (!ZEND_TYPE_IS_SET(arg_info->type)) {
 		return MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_RC1|MAY_BE_RCN;
 	}
 
 	tmp = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(arg_info->type));
-	*pce = NULL;
 	if (ZEND_TYPE_HAS_CLASS(arg_info->type)) {
 		tmp |= MAY_BE_OBJECT;
 		/* As we only have space to store one CE, we use a plain object type for class unions. */

Original file line number	Diff line number	Diff line change
`@@ -2180,12 +2180,13 @@ static uint32_t zend_convert_type_declaration_mask(uint32_t type_mask) {`
`2180`	`2180`	`uint32_t zend_fetch_arg_info_type(const zend_script script, zend_arg_info arg_info, zend_class_entry **pce)`
`2181`	`2181`	`{`
`2182`	`2182`	`uint32_t tmp;`
	`2183`	`+`
	`2184`	`+ *pce = NULL;`
`2183`	`2185`	`if (!ZEND_TYPE_IS_SET(arg_info->type)) {`
`2184`	`2186`	`return MAY_BE_ANY\|MAY_BE_ARRAY_KEY_ANY\|MAY_BE_ARRAY_OF_ANY\|MAY_BE_ARRAY_OF_REF\|MAY_BE_RC1\|MAY_BE_RCN;`
`2185`	`2187`	`}`
`2186`	`2188`
`2187`	`2189`	`tmp = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(arg_info->type));`
`2188`		`- *pce = NULL;`
`2189`	`2190`	`if (ZEND_TYPE_HAS_CLASS(arg_info->type)) {`
`2190`	`2191`	`tmp \|= MAY_BE_OBJECT;`
`2191`	`2192`	`/* As we only have space to store one CE, we use a plain object type for class unions. */`