Fixed uninitialized EX(opline) access (possible Zend/tests/gh12073.phpt crash)

dstogov · dstogov · commit f1f608bf53c6 · 2023-09-05T10:11:54.000+03:00
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
@@ -8002,6 +8002,7 @@ ZEND_VM_HANDLER(142, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, NUM)
 		called_scope = Z_CE(EX(This));
 		object = NULL;
 	}
+	SAVE_OPLINE();
 	zend_create_closure(EX_VAR(opline->result.var), func,
 		EX(func)->op_array.scope, called_scope, object);
 
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
@@ -5366,6 +5366,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_C
 		called_scope = Z_CE(EX(This));
 		object = NULL;
 	}
+	SAVE_OPLINE();
 	zend_create_closure(EX_VAR(opline->result.var), func,
 		EX(func)->op_array.scope, called_scope, object);
 

Original file line number	Diff line number	Diff line change
`@@ -8002,6 +8002,7 @@ ZEND_VM_HANDLER(142, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, NUM)`
`8002`	`8002`	`called_scope = Z_CE(EX(This));`
`8003`	`8003`	`object = NULL;`
`8004`	`8004`	`}`
	`8005`	`+ SAVE_OPLINE();`
`8005`	`8006`	`zend_create_closure(EX_VAR(opline->result.var), func,`
`8006`	`8007`	`EX(func)->op_array.scope, called_scope, object);`
`8007`	`8008`
Original file line number	Diff line number	Diff line change
`@@ -5366,6 +5366,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_C`
`5366`	`5366`	`called_scope = Z_CE(EX(This));`
`5367`	`5367`	`object = NULL;`
`5368`	`5368`	`}`
	`5369`	`+ SAVE_OPLINE();`
`5369`	`5370`	`zend_create_closure(EX_VAR(opline->result.var), func,`
`5370`	`5371`	`EX(func)->op_array.scope, called_scope, object);`
`5371`	`5372`