Skip to content

Commit dd33535

Browse files
committed
Fix infinite recursion in unlinked_instanceof
I suspect this is only a partial fix for the issue, it's probably possible to recurse through a more complex pathway as well. Fixes oss-fuzz #28961.
1 parent 5e57f37 commit dd33535

File tree

2 files changed

+19
-1
lines changed

2 files changed

+19
-1
lines changed
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Infinite recursion in unlinked_instanceof()
3+
--FILE--
4+
<?php
5+
interface I {}
6+
spl_autoload_register(function() {
7+
class X {
8+
function test(): I {}
9+
}
10+
class Y extends X {
11+
function test(): C {}
12+
}
13+
});
14+
class C extends Z implements C {}
15+
?>
16+
--EXPECTF--
17+
Fatal error: Declaration of Y::test(): C must be compatible with X::test(): I in %s on line %d

Zend/zend_inheritance.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,8 @@ static zend_bool unlinked_instanceof(zend_class_entry *ce1, zend_class_entry *ce
311311
zend_class_entry *ce = zend_lookup_class_ex(
312312
ce1->interface_names[i].name, ce1->interface_names[i].lc_name,
313313
ZEND_FETCH_CLASS_ALLOW_UNLINKED | ZEND_FETCH_CLASS_NO_AUTOLOAD);
314-
if (ce && unlinked_instanceof(ce, ce2)) {
314+
/* Avoid recursing if class implements ifself. */
315+
if (ce && ce != ce1 && unlinked_instanceof(ce, ce2)) {
315316
return 1;
316317
}
317318
}

0 commit comments

Comments
 (0)