Fix #77638: var_export'ing certain class instances segfaults

If objects return immutable property hash tables (typically,
`zend_empty_array`), we must not try to apply recursion protection on
those.

diff --git a/NEWS b/NEWS
index 2961969c61201e1abdc1edf61dc4f25ed3a19254..4f025197115f34054a7e65a1017615d84270a32f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,7 @@ PHP                                                                        NEWS
 
 - Standard:
   . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
+  . Fixed bug #77638 (var_export'ing certain class instances segfaults). (cmb)
 
 21 Nov 2019, PHP 7.3.12
 

diff --git a/ext/standard/tests/general_functions/bug77638_1.phpt b/ext/standard/tests/general_functions/bug77638_1.phpt
new file mode 100644 (file)
index 0000000..b5ad2b6
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug77638_1.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #77638 (var_export'ing certain class instances segfaults)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+var_export(new COM("Scripting.Dictionary"));
+?>
+--EXPECT--
+com::__set_state(array(
+))

diff --git a/ext/standard/var.c b/ext/standard/var.c
index 2562a410f057255150d718970d7a0af3b7e211d1..a008aab4cbf1ef52cc8f722177e30f6544746ede 100644 (file)
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -524,7 +524,7 @@ again:
                                        zend_error(E_WARNING, "var_export does not handle circular references");
                                        return;
                                } else {
-                                       GC_PROTECT_RECURSION(myht);
+                                       GC_TRY_PROTECT_RECURSION(myht);
                                }
                        }
                        if (level > 1) {
@@ -544,7 +544,7 @@ again:
                                ZEND_HASH_FOREACH_KEY_VAL_IND(myht, index, key, val) {
                                        php_object_element_export(val, index, key, level, buf);
                                } ZEND_HASH_FOREACH_END();
-                               GC_UNPROTECT_RECURSION(myht);
+                               GC_TRY_UNPROTECT_RECURSION(myht);
                        }
                        if (level > 1) {
                                buffer_append_spaces(buf, level - 1);