diff --git a/Zend/tests/gh17162.phpt b/Zend/tests/gh17162.phpt new file mode 100644 index 0000000000000..bdf6ddbb36ba7 --- /dev/null +++ b/Zend/tests/gh17162.phpt @@ -0,0 +1,21 @@ +--TEST-- +GH-17162 (zend_array_try_init() with dtor can cause engine UAF) +--FILE-- +value = null; + } +} +$box = [new Test]; +// Using getimagesize() for the test because it's always available, +// but any function that uses zend_try_array_init() would work. +try { + getimagesize("dummy", $box); +} catch (Error $e) { + echo $e->getMessage(), "\n"; +} +?> +--EXPECT-- +Attempt to assign property "value" on null diff --git a/Zend/zend_API.h b/Zend/zend_API.h index 1114eeeec14ef..59d489f7aeea2 100644 --- a/Zend/zend_API.h +++ b/Zend/zend_API.h @@ -1478,7 +1478,10 @@ static zend_always_inline zval *zend_try_array_init_size(zval *zv, uint32_t size } zv = &ref->val; } - zval_ptr_dtor(zv); + zval garbage; + ZVAL_COPY_VALUE(&garbage, zv); + ZVAL_NULL(zv); + zval_ptr_dtor(&garbage); ZVAL_ARR(zv, arr); return zv; }