Skip to content

Fix OSS-Fuzz #536440507: Immutable class incorrect assertion #23781

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ndossche wants to merge 1 commit into
base: PHP-8.4
Choose a base branch
from
+42 −7
Open

Fix OSS-Fuzz #536440507: Immutable class incorrect assertion #23781

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions Zend/tests/lazy_objects/oss_fuzz_536440507.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
--TEST--
OSS-Fuzz #536440507 (Immutable class incorrect assertion)
--EXTENSIONS--
opcache
--INI--
opcache.enable=1
opcache.enable_cli=1
--FILE--
<?php

class C {
// Something that emits a warning so it can't be folded at compile time
public mixed $b = 340282366920938463454151235394913%435650;
}
$o = (new ReflectionClass(C::class))->newLazyGhost(function ($obj) {});
var_dump($o->b);

?>
--EXPECTF--
Deprecated: Implicit conversion from float 3.4028236692093845E+32 to int loses precision in %s on line %d
int(%s)
28 changes: 21 additions & 7 deletions Zend/zend_lazy_objects.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,18 @@ bool zend_lazy_object_decr_lazy_props(zend_object *obj)
return info->lazy_properties_count == 0;
}

/* See zend_update_class_constants(). */
static zend_always_inline bool zend_class_constants_are_updated(const zend_class_entry *ce) {
if (ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED) {
return true;
}
if (ZEND_MAP_PTR(ce->mutable_data)) {
const zend_class_mutable_data *mutable_data = ZEND_MAP_PTR_GET_IMM(ce->mutable_data);
return mutable_data && (mutable_data->ce_flags & ZEND_ACC_CONSTANTS_UPDATED);
}
return false;
}

/**
* Making objects lazy
*/
Expand Down Expand Up @@ -259,11 +271,9 @@ ZEND_API zend_object *zend_object_make_lazy(zend_object *obj,
return NULL;
}

if (UNEXPECTED(!(reflection_ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED))) {
if (UNEXPECTED(zend_update_class_constants(reflection_ce) != SUCCESS)) {
ZEND_ASSERT(EG(exception));
return NULL;
}
if (UNEXPECTED(zend_update_class_constants(reflection_ce) != SUCCESS)) {
ZEND_ASSERT(EG(exception));
return NULL;
}

obj = zend_objects_new(reflection_ce);
Expand Down Expand Up @@ -383,7 +393,9 @@ ZEND_API zend_object *zend_lazy_object_mark_as_initialized(zend_object *obj)

zend_class_entry *ce = obj->ce;

ZEND_ASSERT(ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED);
#if ZEND_DEBUG
ZEND_ASSERT(zend_class_constants_are_updated(ce));
#endif

zval *default_properties_table = CE_DEFAULT_PROPERTIES_TABLE(ce);
zval *properties_table = obj->properties_table;
Expand Down Expand Up @@ -579,7 +591,9 @@ ZEND_API zend_object *zend_lazy_object_init(zend_object *obj)

zend_class_entry *ce = obj->ce;

ZEND_ASSERT(ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED);
#if ZEND_DEBUG
ZEND_ASSERT(zend_class_constants_are_updated(ce));
#endif

if (zend_object_is_lazy_proxy(obj)) {
return zend_lazy_object_init_proxy(obj);
Expand Down
Loading