Merge branch 'PHP-7.4'

* PHP-7.4:
  Fixed bug #79793

Author: nikic

Zend/tests/bug79793.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Bug #79793: Use after free if string used in undefined index warning is changed
+--FILE--
+<?php
+
+$key = "foo";
+$key .= "bar";
+set_error_handler(function($_, $m) use (&$key) {
+    echo "$m\n";
+    $key .= "baz";
+});
+
+$ary = [];
+$ary[$key]++;
+var_dump($ary);
+$ary[$key] += 1;
+var_dump($ary);
+
+?>
+--EXPECT--
+Undefined index: foobar
+array(1) {
+  ["foobar"]=>
+  int(1)
+}
+Undefined index: foobarbaz
+array(2) {
+  ["foobar"]=>
+  int(1)
+  ["foobarbaz"]=>
+  int(1)
+}

Zend/zend_execute.c

@@ -2128,10 +2128,15 @@ static zend_always_inline zval *zend_fetch_dimension_address_inner(HashTable *ht
 					retval = &EG(uninitialized_zval);
 					break;
 				case BP_VAR_RW:
+					/* Key may be released while throwing the undefined index warning. */
+					zend_string_addref(offset_key);
 					if (UNEXPECTED(zend_undefined_index_write(ht, offset_key) == FAILURE)) {
+						zend_string_release(offset_key);
 						return NULL;
 					}
-					/* break missing intentionally */
+					retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
+					zend_string_release(offset_key);
+					break;
 				case BP_VAR_W:
 					retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
 					break;

ext/opcache/jit/zend_jit_helpers.c

@@ -162,10 +162,14 @@ static zval* ZEND_FASTCALL zend_jit_hash_lookup_rw(HashTable *ht, zend_string *s
 			}
 		}
 	} else {
+		/* Key may be released while throwing the undefined index warning. */
+		zend_string_addref(str);
 		if (UNEXPECTED(zend_undefined_index_write(ht, str) == FAILURE)) {
+			zend_string_release(str);
 			return NULL;
 		}
-		retval = zend_hash_update(ht, str, &EG(uninitialized_zval));
+		retval = zend_hash_add_new(ht, str, &EG(uninitialized_zval));
+		zend_string_release(str);
 	}
 	return retval;
 }
@@ -229,10 +233,14 @@ static zval* ZEND_FASTCALL zend_jit_symtable_lookup_rw(HashTable *ht, zend_strin
 			}
 		}
 	} else {
+		/* Key may be released while throwing the undefined index warning. */
+		zend_string_addref(str);
 		if (UNEXPECTED(zend_undefined_index_write(ht, str) == FAILURE)) {
+			zend_string_release(str);
 			return NULL;
 		}
 		retval = zend_hash_add_new(ht, str, &EG(uninitialized_zval));
+		zend_string_release(str);
 	}
 	return retval;
 }
@@ -571,10 +579,14 @@ static zval* ZEND_FASTCALL zend_jit_fetch_dim_rw_helper(zend_array *ht, zval *di
 			}
 		}
 	} else {
+		/* Key may be released while throwing the undefined index warning. */
+		zend_string_addref(offset_key);
 		if (UNEXPECTED(zend_undefined_index_write(ht, offset_key) == FAILURE)) {
+			zend_string_release(offset_key);
 			return NULL;
 		}
 		retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
+		zend_string_release(offset_key);
 	}
 	return retval;