Skip to content

Commit e6e9bea

Browse files
committed
Avoid uninitialized entries in properties_info_table
Also don't place it into xlat, there's only ever one user.
1 parent fae2246 commit e6e9bea

File tree

2 files changed

+14
-7
lines changed

2 files changed

+14
-7
lines changed

Zend/zend_inheritance.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -855,19 +855,22 @@ static void do_inherit_class_constant(zend_string *name, zend_class_constant *pa
855855
void zend_build_properties_info_table(zend_class_entry *ce)
856856
{
857857
zend_property_info **table, *prop;
858+
size_t size;
858859
if (ce->default_properties_count == 0) {
859860
return;
860861
}
861862

862863
ZEND_ASSERT(ce->properties_info_table == NULL);
864+
size = sizeof(zend_property_info *) * ce->default_properties_count;
863865
if (ce->type == ZEND_USER_CLASS) {
864-
ce->properties_info_table = table = zend_arena_alloc(&CG(arena),
865-
sizeof(zend_property_info *) * ce->default_properties_count);
866+
ce->properties_info_table = table = zend_arena_alloc(&CG(arena), size);
866867
} else {
867-
ce->properties_info_table = table = pemalloc(
868-
sizeof(zend_property_info *) * ce->default_properties_count, 1);
868+
ce->properties_info_table = table = pemalloc(size, 1);
869869
}
870870

871+
/* Dead slots may be left behind during inheritance. Make sure these are NULLed out. */
872+
memset(table, 0, size);
873+
871874
if (ce->parent && ce->parent->default_properties_count != 0) {
872875
zend_property_info **parent_table = ce->parent->properties_info_table;
873876
memcpy(

ext/opcache/zend_persist.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -860,16 +860,20 @@ static void zend_persist_class_entry(zval *zv)
860860
int i;
861861

862862
size_t size = sizeof(zend_property_info *) * ce->default_properties_count;
863+
ZEND_ASSERT(ce->ce_flags & ZEND_ACC_LINKED);
863864
if (ZCG(is_immutable_class)) {
864-
ce->properties_info_table = zend_shared_memdup_put(
865+
ce->properties_info_table = zend_shared_memdup(
865866
ce->properties_info_table, size);
866867
} else {
867-
ce->properties_info_table = zend_shared_memdup_arena_put(
868+
ce->properties_info_table = zend_shared_memdup_arena(
868869
ce->properties_info_table, size);
869870
}
870871

871872
for (i = 0; i < ce->default_properties_count; i++) {
872-
ce->properties_info_table[i] = zend_shared_alloc_get_xlat_entry(ce->properties_info_table[i]);
873+
if (ce->properties_info_table[i]) {
874+
ce->properties_info_table[i] = zend_shared_alloc_get_xlat_entry(
875+
ce->properties_info_table[i]);
876+
}
873877
}
874878
}
875879

0 commit comments

Comments
 (0)