From c7920aba3e1892accca7cd13ef5b8a8fbf48b5c2 Mon Sep 17 00:00:00 2001 From: Xinchen Hui Date: Thu, 14 Mar 2019 16:46:04 +0800 Subject: [PATCH] Fixed bug #77738 (Nullptr deref in zend_compile_expr) --- NEWS | 1 + Zend/tests/bug77738.phpt | 8 ++++++++ Zend/zend_compile.c | 4 ++-- 3 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 Zend/tests/bug77738.phpt diff --git a/NEWS b/NEWS index 671df5654f..a088343e21 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,7 @@ PHP NEWS ?? ??? 2019, PHP 7.2.17 - Core: + . Fixed bug #77738 (Nullptr deref in zend_compile_expr). (Laruence) . Fixed bug #77660 (Segmentation fault on break 2147483648). (Laruence) . Fixed bug #77652 (Anonymous classes can lose their interface information). (Nikita) diff --git a/Zend/tests/bug77738.phpt b/Zend/tests/bug77738.phpt new file mode 100644 index 0000000000..e3a453c405 --- /dev/null +++ b/Zend/tests/bug77738.phpt @@ -0,0 +1,8 @@ +--TEST-- +Bug #77738 (Nullptr deref in zend_compile_expr) +--FILE-- +attr != ZEND_NAME_RELATIVE && zend_string_equals_literal(orig_name, "__COMPILER_HALT_OFFSET__"))) { zend_ast *last = CG(ast); - while (last->kind == ZEND_AST_STMT_LIST) { + while (last && last->kind == ZEND_AST_STMT_LIST) { zend_ast_list *list = zend_ast_get_list(last); last = list->child[list->children-1]; } - if (last->kind == ZEND_AST_HALT_COMPILER) { + if (last && last->kind == ZEND_AST_HALT_COMPILER) { result->op_type = IS_CONST; ZVAL_LONG(&result->u.constant, Z_LVAL_P(zend_ast_get_zval(last->child[0]))); zend_string_release(resolved_name); -- 2.49.0