Skip to content

Commit 25348e8

Browse files
lazergndossche
lazerg
authored and
ndossche
committed
Fix GH-24337: JIT segfault when decrementing a non-numeric string property
Closes GH-24342.
1 parent c2b02f2 commit 25348e8

3 files changed

Lines changed: 111 additions & 3 deletions

File tree

‎NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ PHP NEWS
6060
. Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)
6161
. Fixed bug GH-24218 (Invalid opcode for count() of a literal array when
6262
SCCP is disabled). (Lazizbek Ergashev)
63+
. Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
64+
property). (Lazizbek Ergashev)
6365

6466
- PDO:
6567
. Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a

‎ext/opcache/jit/zend_jit_ir.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15823,12 +15823,13 @@ static int zend_jit_incdec_obj(zend_jit_ctx *jit,
1582315823
}
1582415824

1582515825
if (var_info & (MAY_BE_ANY - MAY_BE_LONG)) {
15826-
if (var_info & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
15827-
may_throw = 1;
15828-
}
1582915826
if (if_long) {
1583015827
ir_IF_FALSE_cold(if_long);
1583115828
}
15829+
if (var_info & (MAY_BE_ANY - (MAY_BE_LONG|MAY_BE_DOUBLE))) {
15830+
may_throw = 1;
15831+
jit_SET_EX_OPLINE(jit, opline);
15832+
}
1583215833
if (opline->opcode == ZEND_POST_INC_OBJ || opline->opcode == ZEND_POST_DEC_OBJ) {
1583315834
jit_ZVAL_COPY(jit, res_addr, -1, var_addr, var_info, 1);
1583415835
}

‎ext/opcache/tests/jit/gh24337.phpt‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
--TEST--
2+
GH-24337 (JIT: segfault in zend_get_executed_lineno when decrementing a non-numeric string property)
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=64M
8+
opcache.jit=tracing
9+
opcache.jit_hot_loop=2
10+
opcache.jit_hot_func=2
11+
opcache.jit_hot_return=2
12+
opcache.jit_hot_side_exit=1
13+
--EXTENSIONS--
14+
opcache
15+
--FILE--
16+
<?php
17+
set_error_handler(function ($errno, $errstr, $errfile, $errline) {
18+
echo "$errstr on line $errline\n";
19+
});
20+
class Q {
21+
public $pu = 0;
22+
function run() {
23+
for ($i = 0; $i < 2; $i++) {
24+
$this->pu--;
25+
}
26+
}
27+
function inc() {
28+
for ($i = 0; $i < 2; $i++) {
29+
$this->pu++;
30+
}
31+
}
32+
}
33+
class S extends Q {
34+
public $pu = 'u';
35+
function run() {
36+
parent::run();
37+
}
38+
}
39+
class B extends Q {
40+
public $pu = true;
41+
function run() {
42+
parent::run();
43+
}
44+
}
45+
class A extends Q {
46+
public $pu = [];
47+
function run() {
48+
parent::run();
49+
}
50+
}
51+
$objs = [new Q, new S, new B, new A];
52+
for ($k = 0; $k < 4; $k++) {
53+
foreach ($objs as $o) {
54+
try {
55+
$o->run();
56+
} catch (TypeError $e) {
57+
echo $e->getMessage(), " on line ", $e->getLine(), "\n";
58+
}
59+
try {
60+
$o->inc();
61+
} catch (TypeError $e) {
62+
echo $e->getMessage(), " on line ", $e->getLine(), "\n";
63+
}
64+
}
65+
}
66+
var_dump($objs[0]->pu, $objs[1]->pu, $objs[2]->pu, $objs[3]->pu);
67+
?>
68+
--EXPECT--
69+
Decrement on non-numeric string has no effect and is deprecated on line 9
70+
Decrement on non-numeric string has no effect and is deprecated on line 9
71+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
72+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
73+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
74+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
75+
Cannot decrement array on line 9
76+
Cannot increment array on line 14
77+
Decrement on non-numeric string has no effect and is deprecated on line 9
78+
Decrement on non-numeric string has no effect and is deprecated on line 9
79+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
80+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
81+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
82+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
83+
Cannot decrement array on line 9
84+
Cannot increment array on line 14
85+
Decrement on non-numeric string has no effect and is deprecated on line 9
86+
Decrement on non-numeric string has no effect and is deprecated on line 9
87+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
88+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
89+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
90+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
91+
Cannot decrement array on line 9
92+
Cannot increment array on line 14
93+
Decrement on non-numeric string has no effect and is deprecated on line 9
94+
Decrement on non-numeric string has no effect and is deprecated on line 9
95+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
96+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
97+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
98+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
99+
Cannot decrement array on line 9
100+
Cannot increment array on line 14
101+
int(0)
102+
string(2) "ac"
103+
bool(true)
104+
array(0) {
105+
}

0 commit comments

Comments
 (0)