Skip to content

Commit 9204505

Browse files
dstogovdstogov
committed
Fixed bug #77263 (Segfault when using 2 RecursiveFilterIterator)
1 parent d621283 commit 9204505

File tree

4 files changed

+93
-0
lines changed

4 files changed

+93
-0
lines changed

‎NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ PHP NEWS
1313
. Fixed bug #77339 (__callStatic may get incorrect arguments). (Dmitry)
1414
. Fixed bug #77317 (__DIR__, __FILE__, realpath() reveal physical path for
1515
subst virtual drive). (Anatol)
16+
. Fixed bug #77263 (Segfault when using 2 RecursiveFilterIterator). (Dmitry)
1617

1718
- Fileinfo:
1819
. Fixed bug #77346 (webm files incorrectly detected as

‎Zend/zend_vm_def.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3099,6 +3099,10 @@ ZEND_VM_HOT_OBJ_HANDLER(112, ZEND_INIT_METHOD_CALL, CONST|TMPVAR|UNUSED|THIS|CV,
30993099
EXPECTED(obj == orig_obj)) {
31003100
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
31013101
}
3102+
if ((OP1_TYPE & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
3103+
/* Reset "object" to trigger reference counting */
3104+
object = NULL;
3105+
}
31023106
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
31033107
init_func_run_time_cache(&fbc->op_array);
31043108
}

‎Zend/zend_vm_execute.h

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5148,6 +5148,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
51485148
EXPECTED(obj == orig_obj)) {
51495149
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
51505150
}
5151+
if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
5152+
/* Reset "object" to trigger reference counting */
5153+
object = NULL;
5154+
}
51515155
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
51525156
init_func_run_time_cache(&fbc->op_array);
51535157
}
@@ -7325,6 +7329,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
73257329
EXPECTED(obj == orig_obj)) {
73267330
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
73277331
}
7332+
if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
7333+
/* Reset "object" to trigger reference counting */
7334+
object = NULL;
7335+
}
73287336
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
73297337
init_func_run_time_cache(&fbc->op_array);
73307338
}
@@ -10421,6 +10429,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
1042110429
EXPECTED(obj == orig_obj)) {
1042210430
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
1042310431
}
10432+
if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
10433+
/* Reset "object" to trigger reference counting */
10434+
object = NULL;
10435+
}
1042410436
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
1042510437
init_func_run_time_cache(&fbc->op_array);
1042610438
}
@@ -14149,6 +14161,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
1414914161
EXPECTED(obj == orig_obj)) {
1415014162
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
1415114163
}
14164+
if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
14165+
/* Reset "object" to trigger reference counting */
14166+
object = NULL;
14167+
}
1415214168
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
1415314169
init_func_run_time_cache(&fbc->op_array);
1415414170
}
@@ -15759,6 +15775,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_T
1575915775
EXPECTED(obj == orig_obj)) {
1576015776
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
1576115777
}
15778+
if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
15779+
/* Reset "object" to trigger reference counting */
15780+
object = NULL;
15781+
}
1576215782
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
1576315783
init_func_run_time_cache(&fbc->op_array);
1576415784
}
@@ -17636,6 +17656,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
1763617656
EXPECTED(obj == orig_obj)) {
1763717657
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
1763817658
}
17659+
if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
17660+
/* Reset "object" to trigger reference counting */
17661+
object = NULL;
17662+
}
1763917663
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
1764017664
init_func_run_time_cache(&fbc->op_array);
1764117665
}
@@ -32081,6 +32105,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_S
3208132105
EXPECTED(obj == orig_obj)) {
3208232106
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
3208332107
}
32108+
if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
32109+
/* Reset "object" to trigger reference counting */
32110+
object = NULL;
32111+
}
3208432112
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
3208532113
init_func_run_time_cache(&fbc->op_array);
3208632114
}
@@ -33812,6 +33840,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_T
3381233840
EXPECTED(obj == orig_obj)) {
3381333841
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
3381433842
}
33843+
if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
33844+
/* Reset "object" to trigger reference counting */
33845+
object = NULL;
33846+
}
3381533847
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
3381633848
init_func_run_time_cache(&fbc->op_array);
3381733849
}
@@ -36187,6 +36219,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_C
3618736219
EXPECTED(obj == orig_obj)) {
3618836220
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
3618936221
}
36222+
if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
36223+
/* Reset "object" to trigger reference counting */
36224+
object = NULL;
36225+
}
3619036226
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
3619136227
init_func_run_time_cache(&fbc->op_array);
3619236228
}
@@ -41208,6 +41244,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_S
4120841244
EXPECTED(obj == orig_obj)) {
4120941245
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
4121041246
}
41247+
if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
41248+
/* Reset "object" to trigger reference counting */
41249+
object = NULL;
41250+
}
4121141251
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
4121241252
init_func_run_time_cache(&fbc->op_array);
4121341253
}
@@ -44971,6 +45011,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_TMPVA
4497145011
EXPECTED(obj == orig_obj)) {
4497245012
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
4497345013
}
45014+
if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
45015+
/* Reset "object" to trigger reference counting */
45016+
object = NULL;
45017+
}
4497445018
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
4497545019
init_func_run_time_cache(&fbc->op_array);
4497645020
}
@@ -50769,6 +50813,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HA
5076950813
EXPECTED(obj == orig_obj)) {
5077050814
CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
5077150815
}
50816+
if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
50817+
/* Reset "object" to trigger reference counting */
50818+
object = NULL;
50819+
}
5077250820
if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
5077350821
init_func_run_time_cache(&fbc->op_array);
5077450822
}

‎ext/spl/tests/bug77263.phpt

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
--TEST--
2+
Bug #77263 (Segfault when using 2 RecursiveFilterIterator)
3+
--FILE--
4+
<?php
5+
$dir = __DIR__ . '/bug77263';
6+
mkdir($dir);
7+
mkdir("$dir/subdir");
8+
touch("$dir/file1");
9+
touch("$dir/subdir/file2");
10+
11+
class Filter1 extends RecursiveFilterIterator {
12+
public function accept() { return $this->getInnerIterator()->getSubPathname() != ''; }
13+
}
14+
15+
class Filter2 extends RecursiveFilterIterator {
16+
public function accept() { return $this->getInnerIterator()->getSubPathname() != ' '; }
17+
}
18+
19+
$iterator = new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS );
20+
21+
$iterator = new Filter1( $iterator );
22+
23+
$iterator = new Filter2( $iterator );
24+
25+
$iterator = new RecursiveIteratorIterator( $iterator, RecursiveIteratorIterator::LEAVES_ONLY, RecursiveIteratorIterator::CATCH_GET_CHILD );
26+
27+
foreach ( $iterator as $item ) {
28+
}
29+
?>
30+
OK
31+
--CLEAN--
32+
<?php
33+
$dir = __DIR__ . '/bug77263';
34+
unlink("$dir/file1");
35+
unlink("$dir/subdir/file2");
36+
rmdir("$dir/subdir");
37+
rmdir($dir);
38+
?>
39+
--EXPECT--
40+
OK

0 commit comments

Comments
 (0)