Skip to content

Commit 68fdad8

Browse files
committed
Fix free of uninitialized memory in attributes
Fixes OSS-Fuzz #23140.
1 parent 06ff0e8 commit 68fdad8

File tree

2 files changed

+16
-0
lines changed

2 files changed

+16
-0
lines changed
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
--TEST--
2+
Don't free uninitialized memory if a fatal error occurs in an attribute argument
3+
--FILE--
4+
<?php
5+
6+
<<Attr(a->b::c)>>
7+
function test() {}
8+
9+
?>
10+
--EXPECTF--
11+
Fatal error: Dynamic class names are not allowed in compile-time class constant references in %s on line %d

Zend/zend_attributes.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,11 @@ ZEND_API zend_attribute *zend_add_attribute(HashTable **attributes, zend_bool pe
113113
attr->offset = offset;
114114
attr->argc = argc;
115115

116+
/* Initialize arguments to avoid partial initialization in case of fatal errors. */
117+
for (uint32_t i = 0; i < argc; i++) {
118+
ZVAL_UNDEF(&attr->argv[i]);
119+
}
120+
116121
zend_hash_next_index_insert_ptr(*attributes, attr);
117122

118123
return attr;

0 commit comments

Comments
 (0)