Skip to content

Commit 213852d

Browse files
nikicnikic
committed
Fixed bug #79828
1 parent 86e2b7b commit 213852d

File tree

4 files changed

+69
-2
lines changed

4 files changed

+69
-2
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ PHP NEWS
99
op). (Nikita)
1010
. Fixed bug #79841 (Syntax error in configure / unescaped "[]" in php.m4).
1111
(Nikita)
12+
. Fixed bug #79828 (Segfault when trying to access non-existing variable).
13+
(Nikita)
1214

1315
09 Jul 2020, PHP 8.0.0alpha2
1416

‎Zend/tests/bug79828.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Bug #79828: Segfault when trying to access non-existing variable
3+
--FILE--
4+
<?php
5+
function foo(): AnyType {
6+
return $uninitialized;
7+
}
8+
foo();
9+
?>
10+
--EXPECTF--
11+
Warning: Undefined variable $uninitialized in %s on line %d
12+
13+
Fatal error: Uncaught TypeError: foo(): Return value must be of type AnyType, null returned in %s:%d
14+
Stack trace:
15+
#0 %s(%d): foo()
16+
#1 {main}
17+
thrown in %s on line %d

‎Zend/zend_vm_def.h

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4126,7 +4126,7 @@ ZEND_VM_COLD_CONST_HANDLER(124, ZEND_VERIFY_RETURN_TYPE, CONST|TMP|VAR|UNUSED|CV
41264126
#if !ZEND_VM_SPEC || (OP1_TYPE != IS_UNUSED)
41274127
zval *retval_ref, *retval_ptr;
41284128
zend_arg_info *ret_info = EX(func)->common.arg_info - 1;
4129-
retval_ref = retval_ptr = GET_OP1_ZVAL_PTR(BP_VAR_R);
4129+
retval_ref = retval_ptr = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
41304130

41314131
if (OP1_TYPE == IS_CONST) {
41324132
ZVAL_COPY(EX_VAR(opline->result.var), retval_ptr);
@@ -4144,6 +4144,14 @@ ZEND_VM_COLD_CONST_HANDLER(124, ZEND_VERIFY_RETURN_TYPE, CONST|TMP|VAR|UNUSED|CV
41444144
ZEND_VM_NEXT_OPCODE();
41454145
}
41464146

4147+
if (OP1_TYPE == IS_CV && UNEXPECTED(Z_ISUNDEF_P(retval_ptr))) {
4148+
SAVE_OPLINE();
4149+
retval_ref = retval_ptr = ZVAL_UNDEFINED_OP1();
4150+
if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_NULL) {
4151+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
4152+
}
4153+
}
4154+
41474155
zend_reference *ref = NULL;
41484156
void *cache_slot = CACHE_ADDR(opline->op2.num);
41494157
if (UNEXPECTED(retval_ref != retval_ptr)) {

‎Zend/zend_vm_execute.h

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8825,6 +8825,14 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYP
88258825
ZEND_VM_NEXT_OPCODE();
88268826
}
88278827

8828+
if (IS_CONST == IS_CV && UNEXPECTED(Z_ISUNDEF_P(retval_ptr))) {
8829+
SAVE_OPLINE();
8830+
retval_ref = retval_ptr = ZVAL_UNDEFINED_OP1();
8831+
if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_NULL) {
8832+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
8833+
}
8834+
}
8835+
88288836
zend_reference *ref = NULL;
88298837
void *cache_slot = CACHE_ADDR(opline->op2.num);
88308838
if (UNEXPECTED(retval_ref != retval_ptr)) {
@@ -18934,6 +18942,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_TMP_UN
1893418942
ZEND_VM_NEXT_OPCODE();
1893518943
}
1893618944

18945+
if (IS_TMP_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(retval_ptr))) {
18946+
SAVE_OPLINE();
18947+
retval_ref = retval_ptr = ZVAL_UNDEFINED_OP1();
18948+
if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_NULL) {
18949+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
18950+
}
18951+
}
18952+
1893718953
zend_reference *ref = NULL;
1893818954
void *cache_slot = CACHE_ADDR(opline->op2.num);
1893918955
if (UNEXPECTED(retval_ref != retval_ptr)) {
@@ -26456,6 +26472,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_VAR_UN
2645626472
ZEND_VM_NEXT_OPCODE();
2645726473
}
2645826474

26475+
if (IS_VAR == IS_CV && UNEXPECTED(Z_ISUNDEF_P(retval_ptr))) {
26476+
SAVE_OPLINE();
26477+
retval_ref = retval_ptr = ZVAL_UNDEFINED_OP1();
26478+
if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_NULL) {
26479+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
26480+
}
26481+
}
26482+
2645926483
zend_reference *ref = NULL;
2646026484
void *cache_slot = CACHE_ADDR(opline->op2.num);
2646126485
if (UNEXPECTED(retval_ref != retval_ptr)) {
@@ -33176,6 +33200,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_UNUSED
3317633200
ZEND_VM_NEXT_OPCODE();
3317733201
}
3317833202

33203+
if (IS_UNUSED == IS_CV && UNEXPECTED(Z_ISUNDEF_P(retval_ptr))) {
33204+
SAVE_OPLINE();
33205+
retval_ref = retval_ptr = ZVAL_UNDEFINED_OP1();
33206+
if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_NULL) {
33207+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
33208+
}
33209+
}
33210+
3317933211
zend_reference *ref = NULL;
3318033212
void *cache_slot = CACHE_ADDR(opline->op2.num);
3318133213
if (UNEXPECTED(retval_ref != retval_ptr)) {
@@ -44739,7 +44771,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CV_UNU
4473944771
#if 0 || (IS_CV != IS_UNUSED)
4474044772
zval *retval_ref, *retval_ptr;
4474144773
zend_arg_info *ret_info = EX(func)->common.arg_info - 1;
44742-
retval_ref = retval_ptr = _get_zval_ptr_cv_BP_VAR_R(opline->op1.var EXECUTE_DATA_CC);
44774+
retval_ref = retval_ptr = EX_VAR(opline->op1.var);
4474344775

4474444776
if (IS_CV == IS_CONST) {
4474544777
ZVAL_COPY(EX_VAR(opline->result.var), retval_ptr);
@@ -44757,6 +44789,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CV_UNU
4475744789
ZEND_VM_NEXT_OPCODE();
4475844790
}
4475944791

44792+
if (IS_CV == IS_CV && UNEXPECTED(Z_ISUNDEF_P(retval_ptr))) {
44793+
SAVE_OPLINE();
44794+
retval_ref = retval_ptr = ZVAL_UNDEFINED_OP1();
44795+
if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_NULL) {
44796+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
44797+
}
44798+
}
44799+
4476044800
zend_reference *ref = NULL;
4476144801
void *cache_slot = CACHE_ADDR(opline->op2.num);
4476244802
if (UNEXPECTED(retval_ref != retval_ptr)) {

0 commit comments

Comments
 (0)