Skip to content

Commit c35e391

Browse files
committed
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4: Fix leaked parent property default value
2 parents cc21f5e + 4bfaf54 commit c35e391

File tree

3 files changed

+20
-3
lines changed

3 files changed

+20
-3
lines changed

NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ PHP NEWS
1212
. Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov)
1313
. Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov)
1414
. Fixed bug GH-GH-20914 (Internal enums can be cloned and compared). (Arnaud)
15+
. Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov)
1516

1617
- MbString:
1718
. Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is

Zend/tests/oss-fuzz-474613951.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
OSS-Fuzz #474613951: Leaked parent property default value
3+
--FILE--
4+
<?php
5+
6+
class A {
7+
public $prop = C { get => $this->prop; }
8+
}
9+
10+
class B extends A {
11+
public $prop { get => 42; }
12+
}
13+
14+
?>
15+
===DONE===
16+
--EXPECT--
17+
===DONE===

Zend/zend_inheritance.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1519,10 +1519,9 @@ static void do_inherit_property(zend_property_info *parent_info, zend_string *ke
15191519
}
15201520

15211521
int parent_num = OBJ_PROP_TO_NUM(parent_info->offset);
1522+
/* Don't keep default properties in GC (they may be freed by opcache) */
1523+
zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
15221524
if (child_info->offset != ZEND_VIRTUAL_PROPERTY_OFFSET) {
1523-
/* Don't keep default properties in GC (they may be freed by opcache) */
1524-
zval_ptr_dtor_nogc(&(ce->default_properties_table[parent_num]));
1525-
15261525
if (use_child_prop) {
15271526
ZVAL_UNDEF(&ce->default_properties_table[parent_num]);
15281527
} else {

0 commit comments

Comments
 (0)