Skip to content

Commit b4f61d9

Browse files
committed
Fix #79247: Garbage collecting variant objects segfaults
variant objects have no (declared) properties, so the `get_properties` handlers returns a pointer to constant storage for efficiency reasons. This pointer must not be returned from the `get_gc` handler, though; instead we set up an own `get_gc` handler and return NULL from it, to signal that there are no properties to collect.
1 parent 34bab6c commit b4f61d9

File tree

3 files changed

+22
-1
lines changed

3 files changed

+22
-1
lines changed

NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ PHP NEWS
88
(cmb)
99
. Fixed bug #79242 (COM error constants don't match com_exception codes on
1010
x86). (cmb)
11+
. Fixed bug #79247 (Garbage collecting variant objects segfaults). (cmb)
1112

1213
- CURL:
1314
. Fixed bug #79019 (Copied cURL handles upload empty file). (cmb)

ext/com_dotnet/bug79247.phpt

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
--TEST--
2+
Bug #79247 (Garbage collecting variant objects segfaults)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$keep = new variant(null);
10+
var_dump(gc_collect_cycles());
11+
?>
12+
--EXPECT--
13+
int(0)

ext/com_dotnet/com_handlers.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,13 @@ static HashTable *com_properties_get(zval *object)
243243
return &zend_empty_array;
244244
}
245245

246+
static HashTable *com_get_gc(zval *object, zval **table, int *n)
247+
{
248+
*table = NULL;
249+
*n = 0;
250+
return NULL;
251+
}
252+
246253
static void function_dtor(zval *zv)
247254
{
248255
zend_internal_function *f = (zend_internal_function*)Z_PTR_P(zv);
@@ -573,7 +580,7 @@ zend_object_handlers php_com_object_handlers = {
573580
com_object_count,
574581
NULL, /* get_debug_info */
575582
NULL, /* get_closure */
576-
zend_std_get_gc, /* get_gc */
583+
com_get_gc, /* get_gc */
577584
};
578585

579586
void php_com_object_enable_event_sink(php_com_dotnet_object *obj, int enable)

0 commit comments

Comments
 (0)