Skip to content

Commit a8aa2e4

Browse files
committed
Add failing test for dangling pointer access
zend_observer_fcall_end_all accesses a dangling pointer when the execute_data was allocated on the stack.
1 parent 6e5ef72 commit a8aa2e4

File tree

1 file changed

+32
-0
lines changed

1 file changed

+32
-0
lines changed
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
--TEST--
2+
Bug #81430 (Attribute instantiation leaves dangling execute_data pointer)
3+
--INI--
4+
memory_limit=20M
5+
zend_test.observer.enabled=1
6+
zend_test.observer.observe_all=1
7+
--XFAIL--
8+
The stack allocated execute_data is invalid in zend_observer_fcall_end_all
9+
--FILE--
10+
<?php
11+
12+
#[\Attribute]
13+
class A {
14+
public function __construct() {
15+
array_map("str_repeat", ["\xFF"], [100000000]); // cause a bailout
16+
}
17+
}
18+
19+
#[A]
20+
function B() {}
21+
22+
$r = new \ReflectionFunction("B");
23+
call_user_func([$r->getAttributes(A::class)[0], 'newInstance']);
24+
--EXPECTF--
25+
<!-- init '%s' -->
26+
<file '%s'>
27+
<!-- init A::__construct() -->
28+
<A::__construct>
29+
30+
Fatal error: Allowed memory size of 20971520 bytes exhausted %s in %s on line %d
31+
</A::__construct>
32+
</file '%s'>

0 commit comments

Comments
 (0)