Files
php-src/Zend/tests/oom_call_function.phpt
3584a98bda Avoid state corruption via bailout
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup

Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
2026-10-21 16:06:22 +02:00

19 lines
446 B
PHP

--TEST--
OOM OOM in zend_call_function()
--INI--
memory_limit=10M
--ENV--
call_user_func=call_user_func
--FILE--
<?php
$a = [];
for ($i = 0; $i < 10; $i++) {
/* Check that call_user_func() doesn't reset vm_interrupt without checking for OOMs */
$a[] = getenv('call_user_func')('str_repeat', 'a', 10*1024*1024);
}
?>
--EXPECTF--
Fatal error: Allowed memory size of 10485760 bytes exhausted %S(tried to allocate %d bytes) in %s on line 6