Fixed bug #97599 (coredump in set_error_handler)

laruence · laruence · commit ccd41e083359 · 2020-05-15T15:36:00.000+08:00
diff --git a/NEWS b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? ??? ????, PHP 7.4.7
 
 - Core:
+  . Fixed bug #97599 (coredump in set_error_handler). (Laruence)
   . Fixed bug #79566 (Private SHM is not private on Windows). (cmb)
   . Fixed bug #79489 (.user.ini does not inherit). (cmb)
 
diff --git a/Zend/tests/bug79599.phpt b/Zend/tests/bug79599.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #79599 (coredump in set_error_handler)
+--FILE--
+<?php
+set_error_handler(function($code, $message){
+	throw new \Exception($message);
+});
+function test1(){
+	$a[] = $b;
+}
+function test2(){
+	$a[$c] = $b;
+}
+try{
+	test1();
+}catch(\Exception $e){
+	var_dump($e->getMessage());
+}
+try{
+	test2();
+}catch(\Exception $e){
+	var_dump($e->getMessage());
+}
+?>
+--EXPECT--
+string(21) "Undefined variable: b"
+string(21) "Undefined variable: c"
diff --git a/Zend/zend.c b/Zend/zend.c
@@ -1248,6 +1248,10 @@ ZEND_API zval *zend_get_configuration_directive(zend_string *name) /* {{{ */
 		} \
 	} while (0)
 
+static void arg_copy_ctor(zval *zv) {
+	zval_copy_ctor(zv);
+}
+
 static ZEND_COLD void zend_error_va_list(
 		int type, const char *error_filename, uint32_t error_lineno,
 		const char *format, va_list args)
@@ -1341,7 +1345,9 @@ static ZEND_COLD void zend_error_va_list(
 			if (!symbol_table) {
 				ZVAL_NULL(&params[4]);
 			} else {
-				ZVAL_ARR(&params[4], zend_array_dup(symbol_table));
+				array_init(&params[4]);
+				/* always try to do noninvasive duplication */
+				zend_hash_copy(Z_ARRVAL(params[4]), symbol_table, arg_copy_ctor);
 			}
 
 			ZVAL_COPY_VALUE(&orig_user_error_handler, &EG(user_error_handler));
