From: Christoph M. Becker <cmbecker69@gmx.de>
Date: Mon, 25 Nov 2019 14:44:15 +0000 (+0100)
Subject: Fix #77638: var_export'ing certain class instances segfaults
X-Git-Tag: php-7.3.13RC1~11
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=23c65a817390d219bbe77f363cf14956c5c7119b;p=php

Fix #77638: var_export'ing certain class instances segfaults

If objects return immutable property hash tables (typically,
`zend_empty_array`), we must not try to apply recursion protection on
those.
---

diff --git a/NEWS b/NEWS
index 2961969c61..4f02519711 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,7 @@ PHP                                                                        NEWS
 
 - Standard:
   . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
+  . Fixed bug #77638 (var_export'ing certain class instances segfaults). (cmb)
 
 21 Nov 2019, PHP 7.3.12
 
diff --git a/ext/standard/tests/general_functions/bug77638_1.phpt b/ext/standard/tests/general_functions/bug77638_1.phpt
new file mode 100644
index 0000000000..b5ad2b6acf
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug77638_1.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #77638 (var_export'ing certain class instances segfaults)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+var_export(new COM("Scripting.Dictionary"));
+?>
+--EXPECT--
+com::__set_state(array(
+))
diff --git a/ext/standard/var.c b/ext/standard/var.c
index 2562a410f0..a008aab4cb 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -524,7 +524,7 @@ again:
 					zend_error(E_WARNING, "var_export does not handle circular references");
 					return;
 				} else {
-					GC_PROTECT_RECURSION(myht);
+					GC_TRY_PROTECT_RECURSION(myht);
 				}
 			}
 			if (level > 1) {
@@ -544,7 +544,7 @@ again:
 				ZEND_HASH_FOREACH_KEY_VAL_IND(myht, index, key, val) {
 					php_object_element_export(val, index, key, level, buf);
 				} ZEND_HASH_FOREACH_END();
-				GC_UNPROTECT_RECURSION(myht);
+				GC_TRY_UNPROTECT_RECURSION(myht);
 			}
 			if (level > 1) {
 				buffer_append_spaces(buf, level - 1);