Skip to content

Commit 6797f33

Browse files
committed
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0: Fix use after free
2 parents 729be46 + 0b8e471 commit 6797f33

File tree

2 files changed

+16
-1
lines changed

2 files changed

+16
-1
lines changed
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
User streams and incrrectly typed context
3+
--FILE--
4+
<?php
5+
class Wrapper {
6+
public Foo $context;
7+
}
8+
if (stream_wrapper_register('foo', Wrapper::class)) dir('foo://');
9+
?>
10+
--EXPECTF--
11+
Fatal error: Uncaught TypeError: Cannot assign resource to property Wrapper::$context of type Foo in %suser_streams_context_001.php:5
12+
Stack trace:
13+
#0 %suser_streams_context_001.php(5): dir('foo://')
14+
#1 {main}
15+
thrown in %suser_streams_context_001.php on line 5

main/streams/userspace.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,8 +289,8 @@ static void user_stream_create_object(struct php_user_stream_wrapper *uwrap, php
289289
}
290290

291291
if (context) {
292-
add_property_resource(object, "context", context->res);
293292
GC_ADDREF(context->res);
293+
add_property_resource(object, "context", context->res);
294294
} else {
295295
add_property_null(object, "context");
296296
}

0 commit comments

Comments
 (0)