Skip to content

Commit 5ca2dd3

Browse files
committed
Fixed assertion after clobbering object by user error handler, because
of creation dynamic property deprecation warning. Fixes oss-fuzz #44932
1 parent 8e00da3 commit 5ca2dd3

File tree

2 files changed

+13
-2
lines changed

2 files changed

+13
-2
lines changed

Zend/tests/dynamic_prop_deprecation_002.phpt

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,12 @@ set_error_handler(function($code, $msg){
77
$GLOBALS['a']=null;
88
});
99
$a = new class{};
10-
[&$a->y];
10+
try {
11+
[&$a->y];
12+
} catch (Throwable $ex) {
13+
echo "Exception: " .$ex->getMessage() . "\n";
14+
}
1115
?>
1216
--EXPECT--
13-
Err: Creation of dynamic property class@anonymous::$y is deprecated
17+
Err: Creation of dynamic property class@anonymous::$y is deprecated
18+
Exception: Cannot create dynamic property class@anonymous::$y

Zend/zend_object_handlers.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,13 @@ static ZEND_COLD zend_never_inline bool zend_deprecated_dynamic_property(
283283
zend_error(E_DEPRECATED, "Creation of dynamic property %s::$%s is deprecated",
284284
ZSTR_VAL(obj->ce->name), ZSTR_VAL(member));
285285
if (UNEXPECTED(GC_DELREF(obj) == 0)) {
286+
zend_class_entry *ce = obj->ce;
286287
zend_objects_store_del(obj);
288+
if (!EG(exception)) {
289+
/* We cannot continue execution and have to throw an exception */
290+
zend_throw_error(NULL, "Cannot create dynamic property %s::$%s",
291+
ZSTR_VAL(ce->name), ZSTR_VAL(member));
292+
}
287293
return 0;
288294
}
289295
return 1;

0 commit comments

Comments
 (0)