Handle throwing destructor in BIND_STATIC

nikic · nikic · commit ec54ffad1e3b · 2021-09-29T10:17:05.000+02:00
Fixes oss-fuzz #39406.
diff --git a/Zend/tests/bind_static_exception.phpt b/Zend/tests/bind_static_exception.phpt
@@ -0,0 +1,18 @@
+--TEST--
+BIND_STATIC may destroy a variable with a throwing destructor
+--FILE--
+<?php
+class Test {
+    function __destruct() {
+        throw new Exception("Foo");
+    }
+}
+try {
+    $new = new Test;
+    static $new;
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Foo
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
@@ -8652,9 +8652,9 @@ ZEND_VM_HANDLER(183, ZEND_BIND_STATIC, CV, UNUSED, REF)
 
 	value = (zval*)((char*)ht->arData + (opline->extended_value & ~(ZEND_BIND_REF|ZEND_BIND_IMPLICIT)));
 
+	SAVE_OPLINE();
 	if (opline->extended_value & ZEND_BIND_REF) {
 		if (Z_TYPE_P(value) == IS_CONSTANT_AST) {
-			SAVE_OPLINE();
 			if (UNEXPECTED(zval_update_constant_ex(value, EX(func)->op_array.scope) != SUCCESS)) {
 				HANDLE_EXCEPTION();
 			}
@@ -8679,7 +8679,7 @@ ZEND_VM_HANDLER(183, ZEND_BIND_STATIC, CV, UNUSED, REF)
 		ZVAL_COPY(variable_ptr, value);
 	}
 
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 ZEND_VM_HOT_HANDLER(184, ZEND_FETCH_THIS, UNUSED, UNUSED)
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
@@ -46983,9 +46983,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BIND_STATIC_SPEC_CV_UNUSED_HAN
 
 	value = (zval*)((char*)ht->arData + (opline->extended_value & ~(ZEND_BIND_REF|ZEND_BIND_IMPLICIT)));
 
+	SAVE_OPLINE();
 	if (opline->extended_value & ZEND_BIND_REF) {
 		if (Z_TYPE_P(value) == IS_CONSTANT_AST) {
-			SAVE_OPLINE();
 			if (UNEXPECTED(zval_update_constant_ex(value, EX(func)->op_array.scope) != SUCCESS)) {
 				HANDLE_EXCEPTION();
 			}
@@ -47010,7 +47010,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BIND_STATIC_SPEC_CV_UNUSED_HAN
 		ZVAL_COPY(variable_ptr, value);
 	}
 
-	ZEND_VM_NEXT_OPCODE();
+	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CHECK_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)

Original file line number	Diff line number	Diff line change
`@@ -8652,9 +8652,9 @@ ZEND_VM_HANDLER(183, ZEND_BIND_STATIC, CV, UNUSED, REF)`
`8652`	`8652`
`8653`	`8653`	`value = (zval)((char)ht->arData + (opline->extended_value & ~(ZEND_BIND_REF\|ZEND_BIND_IMPLICIT)));`
`8654`	`8654`
	`8655`	`+ SAVE_OPLINE();`
`8655`	`8656`	`if (opline->extended_value & ZEND_BIND_REF) {`
`8656`	`8657`	`if (Z_TYPE_P(value) == IS_CONSTANT_AST) {`
`8657`		`- SAVE_OPLINE();`
`8658`	`8658`	`if (UNEXPECTED(zval_update_constant_ex(value, EX(func)->op_array.scope) != SUCCESS)) {`
`8659`	`8659`	`HANDLE_EXCEPTION();`
`8660`	`8660`	`}`
`@@ -8679,7 +8679,7 @@ ZEND_VM_HANDLER(183, ZEND_BIND_STATIC, CV, UNUSED, REF)`
`8679`	`8679`	`ZVAL_COPY(variable_ptr, value);`
`8680`	`8680`	`}`
`8681`	`8681`
`8682`		`- ZEND_VM_NEXT_OPCODE();`
	`8682`	`+ ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();`
`8683`	`8683`	`}`
`8684`	`8684`
`8685`	`8685`	`ZEND_VM_HOT_HANDLER(184, ZEND_FETCH_THIS, UNUSED, UNUSED)`
Original file line number	Diff line number	Diff line change
`@@ -46983,9 +46983,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BIND_STATIC_SPEC_CV_UNUSED_HAN`
`46983`	`46983`
`46984`	`46984`	`value = (zval)((char)ht->arData + (opline->extended_value & ~(ZEND_BIND_REF\|ZEND_BIND_IMPLICIT)));`
`46985`	`46985`
	`46986`	`+ SAVE_OPLINE();`
`46986`	`46987`	`if (opline->extended_value & ZEND_BIND_REF) {`
`46987`	`46988`	`if (Z_TYPE_P(value) == IS_CONSTANT_AST) {`
`46988`		`- SAVE_OPLINE();`
`46989`	`46989`	`if (UNEXPECTED(zval_update_constant_ex(value, EX(func)->op_array.scope) != SUCCESS)) {`
`46990`	`46990`	`HANDLE_EXCEPTION();`
`46991`	`46991`	`}`
`@@ -47010,7 +47010,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BIND_STATIC_SPEC_CV_UNUSED_HAN`
`47010`	`47010`	`ZVAL_COPY(variable_ptr, value);`
`47011`	`47011`	`}`
`47012`	`47012`
`47013`		`- ZEND_VM_NEXT_OPCODE();`
	`47013`	`+ ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();`
`47014`	`47014`	`}`
`47015`	`47015`
`47016`	`47016`	`static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CHECK_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)`