Skip to content

Commit ce3846c

Browse files
committed
Merge branch 'PHP-8.0'
* PHP-8.0: Fix use after free on compound division by zero
2 parents cee33ba + 62ecf54 commit ce3846c

File tree

2 files changed

+22
-6
lines changed

2 files changed

+22
-6
lines changed
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Division by zero in compound assignment with refcounted operand
3+
--FILE--
4+
<?php
5+
$h = "1";
6+
$h .= "2";
7+
try {
8+
$h /= 0;
9+
} catch (DivisionByZeroError $e) {
10+
echo $e->getMessage(), "\n";
11+
}
12+
var_dump($h);
13+
?>
14+
--EXPECT--
15+
Division by zero
16+
string(2) "12"

Zend/zend_operators.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1358,7 +1358,7 @@ ZEND_API zend_result ZEND_FASTCALL div_function(zval *result, zval *op1, zval *o
13581358

13591359
ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_DIV);
13601360

1361-
zval op1_copy, op2_copy;
1361+
zval result_copy, op1_copy, op2_copy;
13621362
if (UNEXPECTED(zendi_try_convert_scalar_to_number(op1, &op1_copy) == FAILURE)
13631363
|| UNEXPECTED(zendi_try_convert_scalar_to_number(op2, &op2_copy) == FAILURE)) {
13641364
zend_binop_error("/", op1, op2);
@@ -1368,12 +1368,12 @@ ZEND_API zend_result ZEND_FASTCALL div_function(zval *result, zval *op1, zval *o
13681368
return FAILURE;
13691369
}
13701370

1371-
if (result == op1) {
1372-
zval_ptr_dtor(result);
1373-
}
1374-
1375-
retval = div_function_base(result, &op1_copy, &op2_copy);
1371+
retval = div_function_base(&result_copy, &op1_copy, &op2_copy);
13761372
if (retval == SUCCESS) {
1373+
if (result == op1) {
1374+
zval_ptr_dtor(result);
1375+
}
1376+
ZVAL_COPY_VALUE(result, &result_copy);
13771377
return SUCCESS;
13781378
}
13791379

0 commit comments

Comments
 (0)