Skip to content

Commit 4172b60

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix segfault when assigning to backing value by-ref from hook
2 parents e3798c2 + ab6977d commit 4172b60

File tree

2 files changed

+23
-1
lines changed

2 files changed

+23
-1
lines changed

Zend/tests/oss-fuzz-391975641.phpt

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
OSS-Fuzz #391975641: Segfault when creating reference from backing value
3+
--FILE--
4+
<?php
5+
6+
class C {
7+
public $prop {
8+
get => $this->prop;
9+
set {
10+
$this->prop = &$value;
11+
$value = &$this->prop;
12+
}
13+
}
14+
}
15+
16+
$c = new C;
17+
$c->prop = 1;
18+
var_dump($c->prop);
19+
20+
?>
21+
--EXPECT--
22+
int(1)

Zend/zend_execute.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -3492,7 +3492,7 @@ static zend_always_inline void zend_assign_to_property_reference(zval *container
34923492

34933493
variable_ptr = zend_wrong_assign_to_variable_reference(
34943494
variable_ptr, value_ptr, &garbage OPLINE_CC EXECUTE_DATA_CC);
3495-
} else if (prop_info) {
3495+
} else if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
34963496
variable_ptr = zend_assign_to_typed_property_reference(prop_info, variable_ptr, value_ptr, &garbage EXECUTE_DATA_CC);
34973497
} else {
34983498
zend_assign_to_variable_reference(variable_ptr, value_ptr, &garbage);

0 commit comments

Comments
 (0)