Skip to content

Fix concat_function use-after-free on out-of-memory error #11297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 22, 2023

Conversation

iluuu1994
Copy link
Member

Introduced by GH-10049

Unfortunately, I was not able to provide a test case for this. The example from 727e26f#commitcomment-114423406 only worked in the very specific case of keeping the file in the project root, and running it without run-tests.php.

Copy link
Member

@nielsdos nielsdos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for debugging and fixing this

@iluuu1994
Copy link
Member Author

Actually, this worked:

--TEST--
Bug #79836 (Segfault in concat_function)
--INI--
memory_limit=10M
--FILE--
<?php
class Foo {
    public function __toString() {
        return str_repeat('a', 10);
    }
}

$i = str_repeat('a', 5 * 1024 * 1024);
$e = new Foo();
$e .= $i;
?>
--EXPECT--

I will amend this test.

@iluuu1994 iluuu1994 force-pushed the fix-string-concat-use-after-free branch 2 times, most recently from c2b6034 to 1f44093 Compare May 22, 2023 17:52
@iluuu1994 iluuu1994 force-pushed the fix-string-concat-use-after-free branch from 1f44093 to b5d9825 Compare May 22, 2023 18:38
@iluuu1994 iluuu1994 merged commit 7790ee8 into php:master May 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants