Skip to content

Commit 912608d

Browse files
committed
JIT: Fixed register clobbering during overflow handling
Fixes oss-fuzz #44535
1 parent 7434909 commit 912608d

File tree

2 files changed

+27
-6
lines changed

2 files changed

+27
-6
lines changed

ext/opcache/jit/zend_jit_x86.dasc

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4457,11 +4457,11 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44574457
(Z_MODE(op2_addr) == IS_CONST_ZVAL && Z_LVAL_P(Z_ZV(op2_addr)) == 1))) {
44584458
if (opcode == ZEND_ADD) {
44594459
|.if X64
4460-
| mov64 rax, 0x43e0000000000000
4460+
| mov64 Ra(tmp_reg), 0x43e0000000000000
44614461
if (Z_MODE(res_addr) == IS_REG) {
4462-
| movd xmm(Z_REG(res_addr)-ZREG_XMM0), rax
4462+
| movd xmm(Z_REG(res_addr)-ZREG_XMM0), Ra(tmp_reg)
44634463
} else {
4464-
| SET_ZVAL_LVAL res_addr, rax
4464+
| SET_ZVAL_LVAL res_addr, Ra(tmp_reg)
44654465
}
44664466
|.else
44674467
| SET_ZVAL_LVAL res_addr, 0
@@ -4470,11 +4470,11 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44704470
break;
44714471
} else if (opcode == ZEND_SUB) {
44724472
|.if X64
4473-
| mov64 rax, 0xc3e0000000000000
4473+
| mov64 Ra(tmp_reg), 0xc3e0000000000000
44744474
if (Z_MODE(res_addr) == IS_REG) {
4475-
| movd xmm(Z_REG(res_addr)-ZREG_XMM0), rax
4475+
| movd xmm(Z_REG(res_addr)-ZREG_XMM0), Ra(tmp_reg)
44764476
} else {
4477-
| SET_ZVAL_LVAL res_addr, rax
4477+
| SET_ZVAL_LVAL res_addr, Ra(tmp_reg)
44784478
}
44794479
|.else
44804480
| SET_ZVAL_LVAL res_addr, 0x00200000
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
JIT ASSIGN_DIM_OP: overflow
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
class test {
11+
public$member;
12+
function __construct(){
13+
$this->member = 9223372036854775807;
14+
$this->member += 1;
15+
}
16+
}
17+
new test();
18+
?>
19+
DONE
20+
--EXPECT--
21+
DONE

0 commit comments

Comments
 (0)