Skip to content

Commit f2e8851

Browse files
committed
Remove func copy optimization for private method with static vars
Not NULLing the static_variables pointer for shadow methods during static var shutdown would be a way to avoid this leak, but unless there's evidence that inherited private methods with static vars are actually a common use-case, I don't think we should keep this kind of fragile edge-case optimization. Fixes OSS-Fuzz #17875.
1 parent 8812350 commit f2e8851

File tree

3 files changed

+17
-10
lines changed

3 files changed

+17
-10
lines changed
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Inheritance of private method with static variable
3+
--FILE--
4+
<?php
5+
6+
class A {
7+
private function m() {
8+
static $x;
9+
}
10+
}
11+
class B extends A {}
12+
13+
?>
14+
===DONE===
15+
--EXPECT--
16+
===DONE===

Zend/zend_execute_API.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ void shutdown_executor(void) /* {{{ */
302302
}
303303
if (ce->ce_flags & ZEND_HAS_STATIC_IN_METHODS) {
304304
zend_op_array *op_array;
305-
ZEND_HASH_FOREACH_PTR(&ce->function_table, op_array) {
305+
ZEND_HASH_FOREACH_PTR(&ce->function_table, op_array) {
306306
if (op_array->type == ZEND_USER_FUNCTION) {
307307
if (op_array->static_variables) {
308308
HashTable *ht = ZEND_MAP_PTR_GET(op_array->static_variables_ptr);

Zend/zend_inheritance.c

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -101,15 +101,6 @@ static zend_always_inline zend_function *zend_duplicate_function(zend_function *
101101
/* reuse the same op_array structure */
102102
return func;
103103
}
104-
if (func->op_array.fn_flags & ZEND_ACC_PRIVATE) {
105-
/* For private methods we reuse the same op_array structure even if
106-
* static variables are used, because it will not end up being used
107-
* anyway. However we still need to addref as the dtor will delref. */
108-
if (!(GC_FLAGS(func->op_array.static_variables) & IS_ARRAY_IMMUTABLE)) {
109-
GC_ADDREF(func->op_array.static_variables);
110-
}
111-
return func;
112-
}
113104
return zend_duplicate_user_function(func);
114105
}
115106
}

0 commit comments

Comments
 (0)