Skip to content

Commit f6907b7

Browse files
committed
Fix use-after-free on object released in hook
Fixes GH-16040
1 parent 6946bbc commit f6907b7

File tree

2 files changed

+22
-2
lines changed

2 files changed

+22
-2
lines changed
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
GH-16040: Use-after-free on object released in hook
3+
--FILE--
4+
<?php
5+
6+
class A {
7+
public $bar {
8+
get {
9+
$GLOBALS['a'] = null;
10+
return 42;
11+
}
12+
}
13+
}
14+
15+
$a = new A();
16+
var_dump($a->bar);
17+
18+
?>
19+
--EXPECT--
20+
int(42)

Zend/zend_object_handlers.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -828,8 +828,8 @@ ZEND_API zval *zend_std_read_property(zend_object *zobj, zend_string *name, int
828828

829829
if (EXPECTED(cache_slot
830830
&& zend_execute_ex == execute_ex
831-
&& zobj->ce->default_object_handlers->read_property == zend_std_read_property
832-
&& !zobj->ce->create_object
831+
&& ce->default_object_handlers->read_property == zend_std_read_property
832+
&& !ce->create_object
833833
&& !zend_is_in_hook(prop_info)
834834
&& !(prop_info->hooks[ZEND_PROPERTY_HOOK_GET]->common.fn_flags & ZEND_ACC_RETURN_REFERENCE))) {
835835
ZEND_SET_PROPERTY_HOOK_SIMPLE_GET(cache_slot);

0 commit comments

Comments
 (0)