Fixed bug #80186

Early exit in FE_RESET if get_properties() returns empty array,
as we cannot add HT iterators to zend_empty_array.

diff --git a/NEWS b/NEWS
index c2662b8c97935d26bfbf730728984eebf9642ffc..d4e7e6e93dd1d2261d42978da8fe06d4114ccedb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
   . Fixed bug #79423 (copy command is limited to size of file it can copy).
     (cmb)
   . Fixed bug #80126 (Covariant return types failing compilation). (Nikita)
+  . Fixed bug #80186 (Segfault when iterating over FFI object). (Nikita)
 
 - Calendar:
   . Fixed bug #80185 (jdtounix() fails after 2037). (cmb)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 40b20f0d9cd01cf545d0df3764b2aeee03d6c989..6305ef8ef4649aaa727c2a3e05adb0b637ec12bf 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -6317,11 +6317,7 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET_R, CONST|TMP|VAR|CV, JMP_ADDR)
                ZEND_VM_NEXT_OPCODE();
        } else if (OP1_TYPE != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
-                       result = EX_VAR(opline->result.var);
-                       ZVAL_COPY_VALUE(result, array_ptr);
-                       if (OP1_TYPE != IS_TMP_VAR) {
-                               Z_ADDREF_P(array_ptr);
-                       }
+                       HashTable *properties;
                        if (Z_OBJ_P(array_ptr)->properties
                         && UNEXPECTED(GC_REFCOUNT(Z_OBJ_P(array_ptr)->properties) > 1)) {
                                if (EXPECTED(!(GC_FLAGS(Z_OBJ_P(array_ptr)->properties) & IS_ARRAY_IMMUTABLE))) {
@@ -6329,8 +6325,18 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET_R, CONST|TMP|VAR|CV, JMP_ADDR)
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
 
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               ZEND_VM_C_GOTO(fe_reset_r_empty);
+                       }
+
+                       result = EX_VAR(opline->result.var);
+                       ZVAL_COPY_VALUE(result, array_ptr);
+                       if (OP1_TYPE != IS_TMP_VAR) {
+                               Z_ADDREF_P(array_ptr);
+                       }
+                       Z_FE_ITER_P(result) = zend_hash_iterator_add(properties, 0);
                        FREE_OP1_IF_VAR();
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -6347,6 +6353,7 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET_R, CONST|TMP|VAR|CV, JMP_ADDR)
                }
        } else {
                zend_error(E_WARNING, "Invalid argument supplied for foreach()");
+ZEND_VM_C_LABEL(fe_reset_r_empty):
                ZVAL_UNDEF(EX_VAR(opline->result.var));
                Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
                FREE_OP1();
@@ -6397,6 +6404,7 @@ ZEND_VM_COLD_CONST_HANDLER(125, ZEND_FE_RESET_RW, CONST|TMP|VAR|CV, JMP_ADDR)
                ZEND_VM_NEXT_OPCODE();
        } else if (OP1_TYPE != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
+                       HashTable *properties;
                        if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
                                if (array_ptr == array_ref) {
                                        ZVAL_NEW_REF(array_ref, array_ref);
@@ -6415,8 +6423,14 @@ ZEND_VM_COLD_CONST_HANDLER(125, ZEND_FE_RESET_RW, CONST|TMP|VAR|CV, JMP_ADDR)
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
 
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t) -1;
+                               ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
+                       }
+
+                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0);
                        FREE_OP1_VAR_PTR();
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d4a1c7b4414cd13d189286204ef8ad594f0c7713..770f9667c95f4e43eaf9e38fe19dfec037fba339 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -4140,11 +4140,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_CONST_HANDLER(
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_CONST != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
-                       result = EX_VAR(opline->result.var);
-                       ZVAL_COPY_VALUE(result, array_ptr);
-                       if (IS_CONST != IS_TMP_VAR) {
-                               Z_ADDREF_P(array_ptr);
-                       }
+                       HashTable *properties;
                        if (Z_OBJ_P(array_ptr)->properties
                         && UNEXPECTED(GC_REFCOUNT(Z_OBJ_P(array_ptr)->properties) > 1)) {
                                if (EXPECTED(!(GC_FLAGS(Z_OBJ_P(array_ptr)->properties) & IS_ARRAY_IMMUTABLE))) {
@@ -4152,7 +4148,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_CONST_HANDLER(
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
+
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               goto fe_reset_r_empty;
+                       }
+
+                       result = EX_VAR(opline->result.var);
+                       ZVAL_COPY_VALUE(result, array_ptr);
+                       if (IS_CONST != IS_TMP_VAR) {
+                               Z_ADDREF_P(array_ptr);
+                       }
+                       Z_FE_ITER_P(result) = zend_hash_iterator_add(properties, 0);
 
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -4168,6 +4175,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_CONST_HANDLER(
                }
        } else {
                zend_error(E_WARNING, "Invalid argument supplied for foreach()");
+fe_reset_r_empty:
                ZVAL_UNDEF(EX_VAR(opline->result.var));
                Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
 
@@ -4218,6 +4226,7 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_CONST != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
+                       HashTable *properties;
                        if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
                                if (array_ptr == array_ref) {
                                        ZVAL_NEW_REF(array_ref, array_ref);
@@ -4236,7 +4245,14 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
+
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t) -1;
+                               ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
+                       }
+
+                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0);
 
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -18192,11 +18208,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_TMP_HANDLER(ZE
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_TMP_VAR != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
-                       result = EX_VAR(opline->result.var);
-                       ZVAL_COPY_VALUE(result, array_ptr);
-                       if (IS_TMP_VAR != IS_TMP_VAR) {
-                               Z_ADDREF_P(array_ptr);
-                       }
+                       HashTable *properties;
                        if (Z_OBJ_P(array_ptr)->properties
                         && UNEXPECTED(GC_REFCOUNT(Z_OBJ_P(array_ptr)->properties) > 1)) {
                                if (EXPECTED(!(GC_FLAGS(Z_OBJ_P(array_ptr)->properties) & IS_ARRAY_IMMUTABLE))) {
@@ -18204,7 +18216,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_TMP_HANDLER(ZE
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
+
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               goto fe_reset_r_empty;
+                       }
+
+                       result = EX_VAR(opline->result.var);
+                       ZVAL_COPY_VALUE(result, array_ptr);
+                       if (IS_TMP_VAR != IS_TMP_VAR) {
+                               Z_ADDREF_P(array_ptr);
+                       }
+                       Z_FE_ITER_P(result) = zend_hash_iterator_add(properties, 0);
 
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -18221,6 +18244,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_TMP_HANDLER(ZE
                }
        } else {
                zend_error(E_WARNING, "Invalid argument supplied for foreach()");
+fe_reset_r_empty:
                ZVAL_UNDEF(EX_VAR(opline->result.var));
                Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
                zval_ptr_dtor_nogc(free_op1);
@@ -18271,6 +18295,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_TMP_HANDLER(Z
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_TMP_VAR != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
+                       HashTable *properties;
                        if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
                                if (array_ptr == array_ref) {
                                        ZVAL_NEW_REF(array_ref, array_ref);
@@ -18289,7 +18314,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_TMP_HANDLER(Z
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
+
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t) -1;
+                               ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
+                       }
+
+                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0);
 
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -21282,11 +21314,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_VAR_HANDLER(ZE
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_VAR != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
-                       result = EX_VAR(opline->result.var);
-                       ZVAL_COPY_VALUE(result, array_ptr);
-                       if (IS_VAR != IS_TMP_VAR) {
-                               Z_ADDREF_P(array_ptr);
-                       }
+                       HashTable *properties;
                        if (Z_OBJ_P(array_ptr)->properties
                         && UNEXPECTED(GC_REFCOUNT(Z_OBJ_P(array_ptr)->properties) > 1)) {
                                if (EXPECTED(!(GC_FLAGS(Z_OBJ_P(array_ptr)->properties) & IS_ARRAY_IMMUTABLE))) {
@@ -21294,8 +21322,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_VAR_HANDLER(ZE
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
 
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               goto fe_reset_r_empty;
+                       }
+
+                       result = EX_VAR(opline->result.var);
+                       ZVAL_COPY_VALUE(result, array_ptr);
+                       if (IS_VAR != IS_TMP_VAR) {
+                               Z_ADDREF_P(array_ptr);
+                       }
+                       Z_FE_ITER_P(result) = zend_hash_iterator_add(properties, 0);
                        zval_ptr_dtor_nogc(free_op1);
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -21312,6 +21350,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_VAR_HANDLER(ZE
                }
        } else {
                zend_error(E_WARNING, "Invalid argument supplied for foreach()");
+fe_reset_r_empty:
                ZVAL_UNDEF(EX_VAR(opline->result.var));
                Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
                zval_ptr_dtor_nogc(free_op1);
@@ -21362,6 +21401,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_VAR_HANDLER(Z
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_VAR != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
+                       HashTable *properties;
                        if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
                                if (array_ptr == array_ref) {
                                        ZVAL_NEW_REF(array_ref, array_ref);
@@ -21380,8 +21420,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_VAR_HANDLER(Z
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
 
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t) -1;
+                               ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
+                       }
+
+                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0);
                        if (UNEXPECTED(free_op1)) {zval_ptr_dtor_nogc(free_op1);};
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -37792,11 +37838,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_CV_HANDLER(ZEN
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_CV != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
-                       result = EX_VAR(opline->result.var);
-                       ZVAL_COPY_VALUE(result, array_ptr);
-                       if (IS_CV != IS_TMP_VAR) {
-                               Z_ADDREF_P(array_ptr);
-                       }
+                       HashTable *properties;
                        if (Z_OBJ_P(array_ptr)->properties
                         && UNEXPECTED(GC_REFCOUNT(Z_OBJ_P(array_ptr)->properties) > 1)) {
                                if (EXPECTED(!(GC_FLAGS(Z_OBJ_P(array_ptr)->properties) & IS_ARRAY_IMMUTABLE))) {
@@ -37804,7 +37846,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_CV_HANDLER(ZEN
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
+
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               goto fe_reset_r_empty;
+                       }
+
+                       result = EX_VAR(opline->result.var);
+                       ZVAL_COPY_VALUE(result, array_ptr);
+                       if (IS_CV != IS_TMP_VAR) {
+                               Z_ADDREF_P(array_ptr);
+                       }
+                       Z_FE_ITER_P(result) = zend_hash_iterator_add(properties, 0);
 
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {
@@ -37820,6 +37873,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_R_SPEC_CV_HANDLER(ZEN
                }
        } else {
                zend_error(E_WARNING, "Invalid argument supplied for foreach()");
+fe_reset_r_empty:
                ZVAL_UNDEF(EX_VAR(opline->result.var));
                Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
 
@@ -37870,6 +37924,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_CV_HANDLER(ZE
                ZEND_VM_NEXT_OPCODE();
        } else if (IS_CV != IS_CONST && EXPECTED(Z_TYPE_P(array_ptr) == IS_OBJECT)) {
                if (!Z_OBJCE_P(array_ptr)->get_iterator) {
+                       HashTable *properties;
                        if (IS_CV == IS_VAR || IS_CV == IS_CV) {
                                if (array_ptr == array_ref) {
                                        ZVAL_NEW_REF(array_ref, array_ref);
@@ -37888,7 +37943,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FE_RESET_RW_SPEC_CV_HANDLER(ZE
                                }
                                Z_OBJ_P(array_ptr)->properties = zend_array_dup(Z_OBJ_P(array_ptr)->properties);
                        }
-                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(Z_OBJPROP_P(array_ptr), 0);
+
+                       properties = Z_OBJPROP_P(array_ptr);
+                       if (zend_hash_num_elements(properties) == 0) {
+                               Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t) -1;
+                               ZEND_VM_JMP(OP_JMP_ADDR(opline, opline->op2));
+                       }
+
+                       Z_FE_ITER_P(EX_VAR(opline->result.var)) = zend_hash_iterator_add(properties, 0);
 
                        ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
                } else {

diff --git a/ext/ffi/tests/bug80186.phpt b/ext/ffi/tests/bug80186.phpt
new file mode 100644 (file)
index 0000000..7bd9984
--- /dev/null
+++ b/ext/ffi/tests/bug80186.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #80186 (Segfault when iterating over FFI object)
+--SKIPIF--
+<?php
+if (!extension_loaded('ffi')) die('skip ffi extension not available');
+?>
+--FILE--
+<?php
+$ffi = FFI::cdef('typedef int dummy;');
+foreach ($ffi as $_) { }
+foreach ($ffi as &$_) { }
+?>
+===DONE===
+--EXPECT--
+===DONE===