cvs: ZendEngine2(PHP_5_2) / zend_compile.c zend_vm_def.h zend_vm_execute.h /tests bug44184.phpt php-src NEWS

[email protected] ("Dmitry Stogov")
Newsgroups php.zend-engine.cvs
Message-ID <cvsdmitry1203509092@cvsserver> 
dmitry		Wed Feb 20 12:04:52 2008 UTC

  Added files:                 (Branch: PHP_5_2)
    /ZendEngine2/tests	bug44184.phpt 

  Modified files:              
    /php-src	NEWS 
    /ZendEngine2	zend_compile.c zend_vm_def.h zend_vm_execute.h 
  Log:
  Fixed bug #44184 (Double free of loop-variable on exception)
  
  
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1084&r2=1.2027.2.547.2.1085&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.1084 php-src/NEWS:1.2027.2.547.2.1085
--- php-src/NEWS:1.2027.2.547.2.1084	Wed Feb 20 03:12:16 2008
+++ php-src/NEWS	Wed Feb 20 12:04:48 2008
@@ -10,6 +10,7 @@
   which to group by data is specified. (Ilia)
 - Upgraded PCRE to version 7.6 (Nuno)
 
+- Fixed bug #44184 (Double free of loop-variable on exception). (Dmitry)
 - Fixed bug #44171 (Invalid FETCH_COLUMN index does not raise an error). (Ilia)
 - Fixed Bug #44159 (Crash: $pdo->setAttribute(PDO::STATEMENT_ATTR_CLASS, NULL)).
   (Felipe)
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.c?r1=1.647.2.27.2.47&r2=1.647.2.27.2.48&diff_format=u
Index: ZendEngine2/zend_compile.c
diff -u ZendEngine2/zend_compile.c:1.647.2.27.2.47 ZendEngine2/zend_compile.c:1.647.2.27.2.48
--- ZendEngine2/zend_compile.c:1.647.2.27.2.47	Fri Feb 15 07:44:45 2008
+++ ZendEngine2/zend_compile.c	Wed Feb 20 12:04:49 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_compile.c,v 1.647.2.27.2.47 2008/02/15 07:44:45 dmitry Exp $ */
+/* $Id: zend_compile.c,v 1.647.2.27.2.48 2008/02/20 12:04:49 dmitry Exp $ */
 
 #include <zend_language_parser.h>
 #include "zend.h"
@@ -685,8 +685,14 @@
 }
 
 
-static inline void do_end_loop(int cont_addr TSRMLS_DC)
+static inline void do_end_loop(int cont_addr, int has_loop_var TSRMLS_DC)
 {
+	if (!has_loop_var) {
+		/* The start fileld is used to free temporary variables in case of exceptions.
+		 * We won't try to free something of we don't have loop variable.
+		 */
+		CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].start = -1;
+	}
 	CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].cont = cont_addr;
 	CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].brk = get_next_op_number(CG(active_op_array));
 	CG(active_op_array)->current_brk_cont = CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].parent;
@@ -721,7 +727,7 @@
 	/* update while's conditional jmp */
 	CG(active_op_array)->opcodes[close_bracket_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array));
 
-	do_end_loop(while_token->u.opline_num TSRMLS_CC);
+	do_end_loop(while_token->u.opline_num, 0 TSRMLS_CC);
 
 	DEC_BPC(CG(active_op_array));
 }
@@ -765,7 +771,7 @@
 	SET_UNUSED(opline->op1);
 	SET_UNUSED(opline->op2);
 
-	do_end_loop(second_semicolon_token->u.opline_num+1 TSRMLS_CC);
+	do_end_loop(second_semicolon_token->u.opline_num+1, 0 TSRMLS_CC);
 
 	DEC_BPC(CG(active_op_array));
 }
@@ -2646,7 +2652,7 @@
 	opline->op2.u.opline_num = do_token->u.opline_num;
 	SET_UNUSED(opline->op2);
 
-	do_end_loop(expr_open_bracket->u.opline_num TSRMLS_CC);
+	do_end_loop(expr_open_bracket->u.opline_num, 0 TSRMLS_CC);
 
 	DEC_BPC(CG(active_op_array));
 }
@@ -3891,7 +3897,7 @@
 	CG(active_op_array)->opcodes[foreach_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array)); /* FE_RESET */
 	CG(active_op_array)->opcodes[as_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array)); /* FE_FETCH */
 
-	do_end_loop(as_token->u.opline_num TSRMLS_CC);
+	do_end_loop(as_token->u.opline_num, 1 TSRMLS_CC);
 
 	zend_stack_top(&CG(foreach_copy_stack), (void **) &container_ptr);
 	generate_free_foreach_copy(container_ptr TSRMLS_CC);
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_vm_def.h?r1=1.59.2.29.2.54&r2=1.59.2.29.2.55&diff_format=u
Index: ZendEngine2/zend_vm_def.h
diff -u ZendEngine2/zend_vm_def.h:1.59.2.29.2.54 ZendEngine2/zend_vm_def.h:1.59.2.29.2.55
--- ZendEngine2/zend_vm_def.h:1.59.2.29.2.54	Mon Dec 31 07:20:03 2007
+++ ZendEngine2/zend_vm_def.h	Wed Feb 20 12:04:49 2008
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_vm_def.h,v 1.59.2.29.2.54 2007/12/31 07:20:03 sebastian Exp $ */
+/* $Id: zend_vm_def.h,v 1.59.2.29.2.55 2008/02/20 12:04:49 dmitry Exp $ */
 
 /* If you change this file, please regenerate the zend_vm_execute.h and
  * zend_vm_opcodes.h files by running:
@@ -3826,11 +3826,12 @@
 	}
 
 	for (i=0; i<EX(op_array)->last_brk_cont; i++) {
-		if (EX(op_array)->brk_cont_array[i].start > op_num) {
+		if (EX(op_array)->brk_cont_array[i].start < 0) {
+			continue;
+		} else if (EX(op_array)->brk_cont_array[i].start > op_num) {
 			/* further blocks will not be relevant... */
 			break;
-		}
-		if (op_num < EX(op_array)->brk_cont_array[i].brk) {
+		} else if (op_num < EX(op_array)->brk_cont_array[i].brk) {
 			if (!catched ||
 			    catch_op_num >= EX(op_array)->brk_cont_array[i].brk) {
 				zend_op *brk_opline = &EX(op_array)->opcodes[EX(op_array)->brk_cont_array[i].brk];
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_vm_execute.h?r1=1.62.2.30.2.57&r2=1.62.2.30.2.58&diff_format=u
Index: ZendEngine2/zend_vm_execute.h
diff -u ZendEngine2/zend_vm_execute.h:1.62.2.30.2.57 ZendEngine2/zend_vm_execute.h:1.62.2.30.2.58
--- ZendEngine2/zend_vm_execute.h:1.62.2.30.2.57	Tue Feb 19 16:44:43 2008
+++ ZendEngine2/zend_vm_execute.h	Wed Feb 20 12:04:49 2008
@@ -566,11 +566,12 @@
 	}
 
 	for (i=0; i<EX(op_array)->last_brk_cont; i++) {
-		if (EX(op_array)->brk_cont_array[i].start > op_num) {
+		if (EX(op_array)->brk_cont_array[i].start < 0) {
+			continue;
+		} else if (EX(op_array)->brk_cont_array[i].start > op_num) {
 			/* further blocks will not be relevant... */
 			break;
-		}
-		if (op_num < EX(op_array)->brk_cont_array[i].brk) {
+		} else if (op_num < EX(op_array)->brk_cont_array[i].brk) {
 			if (!catched ||
 			    catch_op_num >= EX(op_array)->brk_cont_array[i].brk) {
 				zend_op *brk_opline = &EX(op_array)->opcodes[EX(op_array)->brk_cont_array[i].brk];

http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug44184.phpt?view=markup&rev=1.1
Index: ZendEngine2/tests/bug44184.phpt
+++ ZendEngine2/tests/bug44184.phpt
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.