Skip to content

Commit 7ad79be

Browse files
committed
Fix use-of-uninitialized-value ast->lineno
Exposed after GH-22833. ast->kind in this context may refer to a ZEND_AST_ZVAL, for which accessing lineno is incorrect. lineno is stored in zval.u2 instead. Fixes OSS-Fuzz-539121135
1 parent 8334703 commit 7ad79be

2 files changed

Lines changed: 13 additions & 1 deletion

File tree

Zend/tests/oss-fuzz-539121135.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
OSS-Fuzz-539121135: Use-of-uninitialized-value ast->lineno
3+
--FILE--
4+
<?php
5+
6+
namespace {}
7+
8+
''
9+
10+
?>
11+
--EXPECTF--
12+
Fatal error: No code may exist outside of namespace {} in %s on line %d

Zend/zend_compile.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12215,7 +12215,7 @@ static void zend_compile_stmt(zend_ast *ast) /* {{{ */
1221512215
return;
1221612216
}
1221712217

12218-
CG(zend_lineno) = ast->lineno;
12218+
CG(zend_lineno) = zend_ast_get_lineno(ast);
1221912219

1222012220
if ((CG(compiler_options) & ZEND_COMPILE_EXTENDED_STMT) && !zend_is_unticked_stmt(ast)) {
1222112221
zend_do_extended_stmt(NULL);

0 commit comments

Comments
 (0)