Skip to content

Commit 2df805d

Browse files
committed
Merge branch 'PHP-8.1'
* PHP-8.1: Fix use after free
2 parents 3a29c2e + 6797f33 commit 2df805d

File tree

2 files changed

+16
-1
lines changed

2 files changed

+16
-1
lines changed
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
User streams and incrrectly typed context
3+
--FILE--
4+
<?php
5+
class Wrapper {
6+
public Foo $context;
7+
}
8+
if (stream_wrapper_register('foo', Wrapper::class)) dir('foo://');
9+
?>
10+
--EXPECTF--
11+
Fatal error: Uncaught TypeError: Cannot assign resource to property Wrapper::$context of type Foo in %suser_streams_context_001.php:5
12+
Stack trace:
13+
#0 %suser_streams_context_001.php(5): dir('foo://')
14+
#1 {main}
15+
thrown in %suser_streams_context_001.php on line 5

main/streams/userspace.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -298,8 +298,8 @@ static void user_stream_create_object(struct php_user_stream_wrapper *uwrap, php
298298
}
299299

300300
if (context) {
301-
add_property_resource(object, "context", context->res);
302301
GC_ADDREF(context->res);
302+
add_property_resource(object, "context", context->res);
303303
} else {
304304
add_property_null(object, "context");
305305
}

0 commit comments

Comments
 (0)