Skip to content

Fix GH-16261: Reference invariant broken in mb_convert_variables() #16272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Fix GH-16261: Reference invariant broken in mb_convert_variables() #16272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions ext/mbstring/mbstring.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3289,7 +3289,7 @@ static int mb_recursive_convert_variable(mbfl_buffer_converter *convd, zval *var
if (ret != NULL) {
zval_ptr_dtor(orig_var);
// TODO: avoid reallocation ???
ZVAL_STRINGL(orig_var, (char *)ret->val, ret->len);
ZVAL_STRINGL(orig_var, (const char *) ret->val, ret->len);
efree(ret->val);
}
} else if (Z_TYPE_P(var) == IS_ARRAY || Z_TYPE_P(var) == IS_OBJECT) {
Expand All @@ -3305,7 +3305,22 @@ static int mb_recursive_convert_variable(mbfl_buffer_converter *convd, zval *var

ht = HASH_OF(var);
if (ht != NULL) {
ZEND_HASH_FOREACH_VAL_IND(ht, entry) {
ZEND_HASH_FOREACH_VAL(ht, entry) {
/* Can be a typed property declaration, in which case we need to remove the reference from the source list.
* Just using ZEND_TRY_ASSIGN_STRINGL is not sufficient because that would not unwrap the reference
* and change values through references (see bug #26639). */
if (Z_TYPE_P(entry) == IS_INDIRECT) {
ZEND_ASSERT(Z_TYPE_P(var) == IS_OBJECT);

entry = Z_INDIRECT_P(entry);
if (Z_ISREF_P(entry) && Z_TYPE_P(Z_REFVAL_P(entry)) == IS_STRING) {
zend_property_info *info = zend_get_typed_property_info_for_slot(Z_OBJ_P(var), entry);
if (info) {
ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(entry), info);
}
}
}

if (mb_recursive_convert_variable(convd, entry)) {
if (Z_REFCOUNTED_P(var)) {
Z_UNPROTECT_RECURSION_P(var);
Expand Down
44 changes: 44 additions & 0 deletions ext/mbstring/tests/gh16261.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
--TEST--
GH-16261 (Reference invariant broken in mb_convert_variables())
--EXTENSIONS--
mbstring
--FILE--
<?php
class Test {
public string $x;
public string $y;
public array $z;
}
$test = new Test;
$ref = "hello";
$ref2 = "world";
$ref3 = [&$ref2];
$test->x =& $ref;
$test->z =& $ref3;
mb_convert_variables("EUC-JP", "Shift_JIS", $test);

class Test2 {
public function __construct(public string $x) {}
}
$test2 = new Test2("foo");

mb_convert_variables("EUC-JP", "Shift_JIS", $test->x);

var_dump($test, $test2);
?>
--EXPECT--
object(Test)#1 (2) {
["x"]=>
string(5) "hello"
["y"]=>
uninitialized(string)
["z"]=>
&array(1) {
[0]=>
string(5) "world"
}
}
object(Test2)#2 (1) {
["x"]=>
string(3) "foo"
}
Loading