mirror of
https://github.com/php/php-src.git
synced 2026-10-28 09:46:46 +08:00
3584a98bda
- Replace bailout on OOM with UnwindExit - Properly reset various globals that may be accessed during startup Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: Jakub Zelenka <bukka@php.net> Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
22 lines
560 B
PHP
22 lines
560 B
PHP
--TEST--
|
|
Delayed OOM while a call frame is only partially built
|
|
--DESCRIPTION--
|
|
A delayed OOM throws from the VM interrupt handler, which runs between two
|
|
oplines. Argument unpacking grows test()'s frame past a VM stack page, so it is
|
|
ZEND_CALL_ALLOCATED and owns the page; the interrupt is then delivered after the
|
|
explode() call, while that frame is still pending.
|
|
--FILE--
|
|
<?php
|
|
|
|
function test(...$args) {}
|
|
|
|
$args = array_fill(0, 20000, 1);
|
|
$str = str_repeat('abcdefgh,', 300);
|
|
|
|
test(...$args, ...[explode(',', $str)]);
|
|
|
|
?>
|
|
===DONE===
|
|
--EXPECT--
|
|
===DONE===
|