Fix heap corruption in zend_parse_arg_str #1073
Conversation
|
@dstogov does this look okay? It's your code, and I don't feel qualified to check this is completely correct. |
| zval converted; | ||
| ZVAL_COPY_VALUE(&converted, arg); | ||
| convert_to_string(&converted); | ||
| *dest = Z_STR(converted); |
There was a problem hiding this comment.
I don't understand this change. This will convert it to string in a separate zval and that string will never get freed. We have to change the value that is on the VM stack to make sure that it will be freed when the function leaves, right?
There was a problem hiding this comment.
Good point. Should probably be just convert_to_string(arg) then.
There was a problem hiding this comment.
The original code looks right. This patch just can't work. I'll need to take a look into your branch.
There was a problem hiding this comment.
Please, take the proper fix from my branch dstogov@66fd52c
There was a problem hiding this comment.
@dstogov Merged fix into strict mode branch, thanks.
Based on Anthony's patch for a bug he discovered. Bug was in the scalar type hints patch, but since it was in this function and @dstogov himself had reviewed the weakly-typed variant of that patch, I doubt it's a scalar type hints issue.