Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commit 73e684f

Browse files
committed
fix zend_string access issues & user after free in error handling code
1 parent cba24df commit 73e684f

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

‎v8js_object_export.cc

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -543,7 +543,7 @@ static void v8js_fake_call_impl(const v8::FunctionCallbackInfo<v8::Value>& info)
543543
if (!info[1]->IsArray()) {
544544
error_len = spprintf(&error, 0,
545545
"%s::__call expects 2nd parameter to be an array",
546-
ce->name);
546+
ZSTR_VAL(ce->name));
547547

548548
if (error_len > std::numeric_limits<int>::max()) {
549549
zend_throw_exception(php_ce_v8js_exception,
@@ -607,14 +607,14 @@ static void v8js_fake_call_impl(const v8::FunctionCallbackInfo<v8::Value>& info)
607607
// okay, look up the method name and manually invoke it.
608608
const zend_object_handlers *h = object->handlers;
609609
zend_function *method_ptr = h->get_method(&object, method_name, NULL);
610-
zend_string_release(method_name);
611610

612611
if (method_ptr == NULL ||
613612
(method_ptr->common.fn_flags & ZEND_ACC_PUBLIC) == 0 ||
614613
(method_ptr->common.fn_flags & (ZEND_ACC_CTOR|ZEND_ACC_DTOR)) != 0) {
615614
error_len = spprintf(&error, 0,
616615
"%s::__call to %s method %s", ZSTR_VAL(ce->name),
617-
(method_ptr == NULL) ? "undefined" : "non-public", method_name);
616+
(method_ptr == NULL) ? "undefined" : "non-public", ZSTR_VAL(method_name));
617+
zend_string_release(method_name);
618618

619619
if (error_len > std::numeric_limits<int>::max()) {
620620
zend_throw_exception(php_ce_v8js_exception,
@@ -629,6 +629,8 @@ static void v8js_fake_call_impl(const v8::FunctionCallbackInfo<v8::Value>& info)
629629
return;
630630
}
631631

632+
zend_string_release(method_name);
633+
632634
v8::Local<v8::FunctionTemplate> tmpl =
633635
v8::Local<v8::FunctionTemplate>::New
634636
(isolate, *reinterpret_cast<v8js_function_tmpl_t *>(self->GetAlignedPointerFromInternalField(0)));

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /