Fixed write_property attempting to modify opcache shared memory when

coercing weak types
pmmp · Feb 19, 2024 · f98dd0e · f98dd0e
1 parent 4183e21
commit f98dd0e
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/handlers.c b/src/handlers.c
@@ -137,9 +137,11 @@ void pmmpthread_write_dimension(PMMPTHREAD_WRITE_DIMENSION_PASSTHRU_D) {
 
 zval* pmmpthread_write_property(PMMPTHREAD_WRITE_PROPERTY_PASSTHRU_D) {
 	zval zmember;
+	zval tmp;
 	zend_guard* guard;
 
 	ZVAL_STR(&zmember, member);
+	ZVAL_UNDEF(&tmp);
 
 	if (object->ce->__set && (guard = zend_get_property_guard(object, member)) && !((*guard) & IN_SET)) {
 		zval rv;
@@ -163,6 +165,12 @@ zval* pmmpthread_write_property(PMMPTHREAD_WRITE_PROPERTY_PASSTHRU_D) {
 					&& execute_data->func
 					&& ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data));
 
+				//zend_verify_property_type() might modify the value
+				//value is not copied before we receive it, so it might be
+				//from opcache protected memory which we can't modify
+				ZVAL_COPY(&tmp, value);
+				value = &tmp;
+
 				if (ZEND_TYPE_IS_SET(info->type) && !zend_verify_property_type(info, value, strict)) {
 					ok = false;
 				}
@@ -180,6 +188,8 @@ zval* pmmpthread_write_property(PMMPTHREAD_WRITE_PROPERTY_PASSTHRU_D) {
 		}
 	}
 
+	zval_ptr_dtor(&tmp);
+
 	return EG(exception) ? &EG(error_zval) : value;
 }
 /* }}} */