Skip to content

Commit b3e3369

Browse files
committed
Fix GH-19397: mb_list_encodings() can cause crashes on shutdown
The request shutdown does not necessarily hold the last reference, if there is still a CV that refers to the array.
1 parent 5cf45ba commit b3e3369

File tree

2 files changed

+15
-2
lines changed

2 files changed

+15
-2
lines changed

ext/mbstring/mbstring.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1165,8 +1165,10 @@ PHP_RSHUTDOWN_FUNCTION(mbstring)
11651165
MBSTRG(outconv_state) = 0;
11661166

11671167
if (MBSTRG(all_encodings_list)) {
1168-
GC_DELREF(MBSTRG(all_encodings_list));
1169-
zend_array_destroy(MBSTRG(all_encodings_list));
1168+
if (GC_DELREF(MBSTRG(all_encodings_list)) == 0) {
1169+
/* must be *array* destroy to remove from GC root buffer and free the hashtable itself */
1170+
zend_array_destroy(MBSTRG(all_encodings_list));
1171+
}
11701172
MBSTRG(all_encodings_list) = NULL;
11711173
}
11721174

ext/mbstring/tests/gh19397.phpt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
--TEST--
2+
GH-19397 (mb_list_encodings() can cause crashes on shutdown)
3+
--EXTENSIONS--
4+
mbstring
5+
--FILE--
6+
<?php
7+
$doNotDeleteThisVariableAssignment = mb_list_encodings();
8+
var_dump(count($doNotDeleteThisVariableAssignment) > 0);
9+
?>
10+
--EXPECT--
11+
bool(true)

0 commit comments

Comments
 (0)