Skip to content

Commit ae77c7b

Browse files
committed
Return correct result code for division by zero
Turns out we do need to return FAILURE here on div by zero exception. Use a three-way return value from div_function_base. Fixes oss-fuzz #25975.
1 parent 4f42519 commit ae77c7b

File tree

2 files changed

+23
-11
lines changed

2 files changed

+23
-11
lines changed

Zend/tests/div_by_zero_in_static.phpt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
--TEST--
2+
Division by zero in static
3+
--FILE--
4+
<?php
5+
static $a = 1/0;
6+
?>
7+
--EXPECTF--
8+
Fatal error: Uncaught DivisionByZeroError: Division by zero in %s:%d
9+
Stack trace:
10+
#0 {main}
11+
thrown in %s on line %d

Zend/zend_operators.c

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1253,7 +1253,9 @@ ZEND_API zend_result ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *o
12531253
}
12541254
/* }}} */
12551255

1256-
static zend_result ZEND_FASTCALL div_function_base(zval *result, zval *op1, zval *op2) /* {{{ */
1256+
/* Returns SUCCESS/FAILURE/TYPES_NOT_HANDLED */
1257+
#define TYPES_NOT_HANDLED 1
1258+
static int ZEND_FASTCALL div_function_base(zval *result, zval *op1, zval *op2) /* {{{ */
12571259
{
12581260
zend_uchar type_pair = TYPE_PAIR(Z_TYPE_P(op1), Z_TYPE_P(op2));
12591261

@@ -1290,23 +1292,25 @@ static zend_result ZEND_FASTCALL div_function_base(zval *result, zval *op1, zval
12901292
ZVAL_DOUBLE(result, (double)Z_LVAL_P(op1) / Z_DVAL_P(op2));
12911293
return SUCCESS;
12921294
} else {
1293-
return FAILURE;
1295+
return TYPES_NOT_HANDLED;
12941296
}
12951297
division_by_0:
12961298
if (result != op1) {
12971299
ZVAL_UNDEF(result);
12981300
}
12991301
zend_throw_error(zend_ce_division_by_zero_error, "Division by zero");
1300-
return SUCCESS;
1302+
return FAILURE;
13011303
}
13021304
/* }}} */
13031305

13041306
ZEND_API zend_result ZEND_FASTCALL div_function(zval *result, zval *op1, zval *op2) /* {{{ */
13051307
{
13061308
ZVAL_DEREF(op1);
13071309
ZVAL_DEREF(op2);
1308-
if (div_function_base(result, op1, op2) == SUCCESS) {
1309-
return SUCCESS;
1310+
1311+
int retval = div_function_base(result, op1, op2);
1312+
if (retval != TYPES_NOT_HANDLED) {
1313+
return retval;
13101314
}
13111315

13121316
ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_DIV);
@@ -1325,12 +1329,9 @@ ZEND_API zend_result ZEND_FASTCALL div_function(zval *result, zval *op1, zval *o
13251329
zval_ptr_dtor(result);
13261330
}
13271331

1328-
if (div_function_base(result, &op1_copy, &op2_copy) == SUCCESS) {
1329-
return SUCCESS;
1330-
}
1331-
1332-
ZEND_ASSERT(0 && "Operation must succeed");
1333-
return FAILURE;
1332+
retval = div_function_base(result, &op1_copy, &op2_copy);
1333+
ZEND_ASSERT(retval != TYPES_NOT_HANDLED && "Types should be handled");
1334+
return retval;
13341335
}
13351336
/* }}} */
13361337

0 commit comments

Comments
 (0)