Skip to content

Commit da43645

Browse files
committed
Fix GH-21244: use after free in zend_test_class_free_obj
Not really a bug, as zend_test shouldn't be used outside of debugging, but let's silence fuzzers. The problem is that the arg info should be cloned as well when the class is cloned; or we fix it the simple way in this patch and make it uncloneable.
1 parent 94c8e01 commit da43645

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

ext/zend_test/test.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,6 +1527,7 @@ PHP_MINIT_FUNCTION(zend_test)
15271527

15281528
memcpy(&zend_test_class_handlers, &std_object_handlers, sizeof(zend_object_handlers));
15291529
zend_test_class_handlers.get_method = zend_test_class_method_get;
1530+
zend_test_class_handlers.clone_obj = NULL;
15301531
zend_test_class_handlers.free_obj = zend_test_class_free_obj;
15311532
zend_test_class_handlers.offset = XtOffsetOf(zend_test_object, std);
15321533

0 commit comments

Comments
 (0)