Skip to content

Commit 5dc78ba

Browse files
andypostGLM-5.1
andcommitted
Fix segfault in do_operation handler (ext-decimal 2.0.x)
Bug was introduced in commit b8b4420 ("Alpha implementation of Number and Rational", Jan 2019) which changed unsupported-operator handling from return FAILURE (1.x) to throw ArithmeticError + return SUCCESS with result zval left uninitialized. The ZEND_TRY_BINARY_OBJECT_OPERATION macro in Zend engine has called do_operation for all operator types (including CONCAT, BW_OR) since PHP 5.6 (commit 089f4967997, Oct 2014). When do_operation throws an exception but returns SUCCESS without initializing result, the VM's exception handler crashes in zval_delref_p. This affects all PHP versions (8.2+), not only PHP 8.5. Fix by setting result to UNDEF before returning SUCCESS for unsupported operators, so the exception handler safely skips cleanup. Co-Authored-By: GLM-5.1 <noreply@z.ai>
1 parent ee7e471 commit 5dc78ba

3 files changed

Lines changed: 3 additions & 0 deletions

File tree

src/decimal.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,7 @@ static php_decimal_success_t php_decimal_do_operation_handler(zend_uchar opcode,
397397
/* Unsupported op type - return success to avoid casting. */
398398
if (UNEXPECTED(op == NULL)) {
399399
php_decimal_operator_not_supported();
400+
ZVAL_UNDEF(result);
400401
return SUCCESS;
401402
}
402403

src/number.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ static php_decimal_success_t php_decimal_number_do_operation(zend_uchar opcode,
105105
/* Unsupported operator - return success to avoid casting. */
106106
if (UNEXPECTED(func == NULL)) {
107107
php_decimal_operator_not_supported();
108+
ZVAL_UNDEF(result);
108109
return SUCCESS;
109110
}
110111

src/rational.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,7 @@ static php_decimal_success_t php_decimal_rational_do_operation(zend_uchar opcode
316316
/* Unsupported operator - return success to avoid casting. */
317317
if (UNEXPECTED(op == NULL)) {
318318
php_decimal_operator_not_supported();
319+
ZVAL_UNDEF(result);
319320
return SUCCESS;
320321
}
321322

0 commit comments

Comments
 (0)