diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2020-12-01 11:31:23 +0100 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-12-01 11:31:23 +0100 |
| commit | 5dfec886d67f01c4e7ea96ef8c26792cb1210047 (patch) | |
| tree | 88398e3b247aa8e927f37a46566365a8ad35f169 /Zend/zend_compile.c | |
| parent | 648cda6c9fc5964df73d65a8b227357f980edca9 (diff) | |
| download | php-git-5dfec886d67f01c4e7ea96ef8c26792cb1210047.tar.gz | |
Fix use after free with file cache and arena allocated strings
Diffstat (limited to 'Zend/zend_compile.c')
| -rw-r--r-- | Zend/zend_compile.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index dbb2194437..83942be570 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -422,6 +422,9 @@ void init_compiler(void) /* {{{ */ void shutdown_compiler(void) /* {{{ */ { + /* Reset filename before destroying the arena, as file cache may use arena allocated strings. */ + zend_restore_compiled_filename(NULL); + zend_stack_destroy(&CG(loop_var_stack)); zend_stack_destroy(&CG(delayed_oplines_stack)); zend_stack_destroy(&CG(short_circuiting_opnums)); @@ -437,7 +440,6 @@ void shutdown_compiler(void) /* {{{ */ FREE_HASHTABLE(CG(delayed_autoloads)); CG(delayed_autoloads) = NULL; } - zend_restore_compiled_filename(NULL); } /* }}} */ |