Skip to content

Fix GH-23811: SplFixedArray leak on re-init and broken setSize() on subclasses - #23812

Open
marc-mabe wants to merge 2 commits into
php:PHP-8.4from
marc-mabe:fix/GH-23811
Open

marc-mabe wants to merge 2 commits into
php:PHP-8.4from
marc-mabe:fix/GH-23811

Conversation

@marc-mabe

Copy link
Copy Markdown
Contributor

Fixes #23811

zend_object_alloc() zeroes the object, so cached_resize started at 0, which
spl_fixedarray_resize() reads as "resize in progress" and returns early.
setSize() therefore did nothing on subclasses whose constructor does not
call parent::__construct(). Initialise the struct on object creation.
setSize(0) clears the array before destroying its elements, so it looks
unconstructed to userland. __construct(), __wakeup() and __unserialize()
then re-initialised it, and the in-progress clear discarded the buffer
they had installed.

cb3dc62 fixed the same leak for a re-entrant setSize() by testing the
resize sentinel first; apply that test to the other three entry points.
@marc-mabe

Copy link
Copy Markdown
Contributor Author

I accidentally rebased from master - fixed that - sorry

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant