Skip to content

Commit 3aaf2f6

Browse files
committed
JIT: Fix memory lek
Fixes oss-fuzz #46462
1 parent 5b048dd commit 3aaf2f6

File tree

2 files changed

+24
-1
lines changed

2 files changed

+24
-1
lines changed

ext/opcache/jit/zend_jit_x86.dasc

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4940,7 +4940,10 @@ static int zend_jit_math_helper(dasm_State **Dst,
49404940
| FREE_OP op1_type, op1, op1_info, 0, opline
49414941
| FREE_OP op2_type, op2, op2_info, 0, opline
49424942
if (may_throw) {
4943-
if (Z_MODE(res_addr) == IS_MEM_ZVAL && Z_REG(res_addr) == ZREG_RX) {
4943+
if (opline->opcode == ZEND_ASSIGN_DIM_OP && (opline->op2_type & (IS_VAR|IS_TMP_VAR))) {
4944+
| MEM_OP2_1_ZTS cmp, aword, executor_globals, exception, 0, r0
4945+
| jne ->exception_handler_free_op2
4946+
} else if (Z_MODE(res_addr) == IS_MEM_ZVAL && Z_REG(res_addr) == ZREG_RX) {
49444947
zend_jit_check_exception_undef_result(Dst, opline);
49454948
} else {
49464949
zend_jit_check_exception(Dst);

ext/opcache/tests/jit/mul_009.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
JIT MUL: 009 memory leak
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
opcache.protect_memory=1
9+
--FILE--
10+
<?php
11+
$x[""][] = 1;
12+
$x[~"$y"] *= 1;
13+
?>
14+
--EXPECTF--
15+
Warning: Undefined variable $y in %smul_009.php on line 3
16+
17+
Fatal error: Uncaught TypeError: Unsupported operand types: array * int in %smul_009.php:3
18+
Stack trace:
19+
#0 {main}
20+
thrown in %smul_009.php on line 3

0 commit comments

Comments
 (0)