Commit 5dc78ba
Fix segfault in do_operation handler (ext-decimal 2.0.x)
Bug was introduced in commit b8b4420 ("Alpha implementation of Number
and Rational", Jan 2019) which changed unsupported-operator handling
from return FAILURE (1.x) to throw ArithmeticError + return SUCCESS
with result zval left uninitialized.
The ZEND_TRY_BINARY_OBJECT_OPERATION macro in Zend engine has called
do_operation for all operator types (including CONCAT, BW_OR) since
PHP 5.6 (commit 089f4967997, Oct 2014). When do_operation throws an
exception but returns SUCCESS without initializing result, the VM's
exception handler crashes in zval_delref_p.
This affects all PHP versions (8.2+), not only PHP 8.5.
Fix by setting result to UNDEF before returning SUCCESS for unsupported
operators, so the exception handler safely skips cleanup.
Co-Authored-By: GLM-5.1 <noreply@z.ai>1 parent ee7e471 commit 5dc78ba
3 files changed
Lines changed: 3 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
397 | 397 | | |
398 | 398 | | |
399 | 399 | | |
| 400 | + | |
400 | 401 | | |
401 | 402 | | |
402 | 403 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
105 | 105 | | |
106 | 106 | | |
107 | 107 | | |
| 108 | + | |
108 | 109 | | |
109 | 110 | | |
110 | 111 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
316 | 316 | | |
317 | 317 | | |
318 | 318 | | |
| 319 | + | |
319 | 320 | | |
320 | 321 | | |
321 | 322 | | |
| |||
0 commit comments