From 1e0bc6e30f9fb327cd06383c8290a8afab1e484d Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Fri, 31 Jul 2020 09:12:22 +0200 Subject: Fix #79919: Stack use-after-scope in define() Instead of the temporary `rv`, we use the `val_free` which is there for this purpose. --- Zend/zend_builtin_functions.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'Zend/zend_builtin_functions.c') diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c index bc3649a622..468a7c3446 100644 --- a/Zend/zend_builtin_functions.c +++ b/Zend/zend_builtin_functions.c @@ -882,9 +882,7 @@ repeat: case IS_OBJECT: if (Z_TYPE(val_free) == IS_UNDEF) { if (Z_OBJ_HT_P(val)->get) { - zval rv; - val = Z_OBJ_HT_P(val)->get(val, &rv); - ZVAL_COPY_VALUE(&val_free, val); + val = Z_OBJ_HT_P(val)->get(val, &val_free); goto repeat; } else if (Z_OBJ_HT_P(val)->cast_object) { if (Z_OBJ_HT_P(val)->cast_object(val, &val_free, IS_STRING) == SUCCESS) { -- cgit v1.2.1