Skip to content

Fix concat_function use-after-free on out-of-memory error#11297

Merged
iluuu1994 merged 1 commit into
php:masterfrom
iluuu1994:fix-string-concat-use-after-free
May 22, 2023
Merged

Fix concat_function use-after-free on out-of-memory error#11297
iluuu1994 merged 1 commit into
php:masterfrom
iluuu1994:fix-string-concat-use-after-free

Conversation

@iluuu1994

Copy link
Copy Markdown
Member

Introduced by GH-10049

Unfortunately, I was not able to provide a test case for this. The example from 727e26f#commitcomment-114423406 only worked in the very specific case of keeping the file in the project root, and running it without run-tests.php.

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for debugging and fixing this

@iluuu1994

Copy link
Copy Markdown
Member Author

Actually, this worked:

--TEST--
Bug #79836 (Segfault in concat_function)
--INI--
memory_limit=10M
--FILE--
<?php
class Foo {
    public function __toString() {
        return str_repeat('a', 10);
    }
}

$i = str_repeat('a', 5 * 1024 * 1024);
$e = new Foo();
$e .= $i;
?>
--EXPECT--

I will amend this test.

@iluuu1994
iluuu1994 force-pushed the fix-string-concat-use-after-free branch 2 times, most recently from c2b6034 to 1f44093 Compare May 22, 2023 17:52
@iluuu1994
iluuu1994 force-pushed the fix-string-concat-use-after-free branch from 1f44093 to b5d9825 Compare May 22, 2023 18:38
@iluuu1994
iluuu1994 merged commit 7790ee8 into php:master May 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants