- Notifications
You must be signed in to change notification settings - Fork 8k
Open
Labels
Description
Description
Due to error handlers, some operations may have unsuspected effects. This is the cause of bugs and workarounds. Quoting GH-6903:
[...] long-standing source of interrupt
vulnerabilities: A notice is emitted during execution of an opcode,
resulting in an error handling being run. The error handler modifies
some data structure the opcode is working on, resulting in UAF or
other memory corruption.
These bugs and workarounds could be avoided by delaying error handlers until a safepoint. Existing/Previous work:
- Delay notice emission until end of opcode #6903
- Delay notice emission until end of opcode #12090
- Delayed notice again #12805
I'm creating this ticket to aggregate issues that would not exist with delayed error handlers:
- Array assignment fails when the array has been resized in error handler #13754
- Assertion failure in Zend/zend_compile.c #15907
- Heap Use-After-Free (UAF) Bug in PHP #16726
- Assertion failure Zend/zend_hash.c:1543 #17416
- ternary reference assignment should be legal #18043
- assertion failure spl_fixedarray #18274
iluuu1994