From 9d89a89d7569152176aaa8efd51a88b05330a564 Mon Sep 17 00:00:00 2001 From: Gustavo Lopes Date: Tue, 23 Dec 2025 10:50:09 +0000 Subject: [PATCH 1/4] Fix use-after-free in FE_FREE with GC interaction When FE_FREE with ZEND_FREE_ON_RETURN frees the loop variable during an early return from a foreach loop, the live range for the loop variable was incorrectly extending past the FE_FREE to the normal loop end. This caused GC to access the already-freed loop variable when it ran after the RETURN opcode, resulting in use-after-free. Fix by splitting the ZEND_LIVE_LOOP range when an FE_FREE with ZEND_FREE_ON_RETURN is encountered: - One range covers the early return path up to the FE_FREE - A separate range covers the normal loop end FE_FREE - Multiple early returns create multiple separate ranges # Conflicts: # Zend/tests/gc_048.phpt # Zend/tests/gc_049.phpt --- Zend/tests/gc_051.phpt | 29 ++++++++++++++++++ Zend/tests/gc_052.phpt | 36 ++++++++++++++++++++++ Zend/tests/{gc_050.phpt => gc_053.phpt} | 0 Zend/zend_opcode.c | 32 ++++++++++++++++++++ Zend/zend_vm_def.h | 40 ++++++++++++++++++++----- Zend/zend_vm_execute.h | 40 ++++++++++++++++++++----- 6 files changed, 163 insertions(+), 14 deletions(-) create mode 100644 Zend/tests/gc_051.phpt create mode 100644 Zend/tests/gc_052.phpt rename Zend/tests/{gc_050.phpt => gc_053.phpt} (100%) diff --git a/Zend/tests/gc_051.phpt b/Zend/tests/gc_051.phpt new file mode 100644 index 0000000000000..575a25a108a15 --- /dev/null +++ b/Zend/tests/gc_051.phpt @@ -0,0 +1,29 @@ +--TEST-- +GC 048: FE_FREE should mark variable as UNDEF to prevent use-after-free during GC +--FILE-- +ref = $b; + $b->ref = $a; + + $result = test_foreach_early_return("x"); +} + +echo "OK\n"; +?> +--EXPECT-- +OK diff --git a/Zend/tests/gc_052.phpt b/Zend/tests/gc_052.phpt new file mode 100644 index 0000000000000..dd15c56bcbf54 --- /dev/null +++ b/Zend/tests/gc_052.phpt @@ -0,0 +1,36 @@ +--TEST-- +GC 049: Multiple early returns from foreach should create separate live ranges +--FILE-- +r = $b; + $b->r = $a; + + $r = f($i % 3 + 1); +} +echo "OK\n"; +?> +--EXPECT-- +OK diff --git a/Zend/tests/gc_050.phpt b/Zend/tests/gc_053.phpt similarity index 100% rename from Zend/tests/gc_050.phpt rename to Zend/tests/gc_053.phpt diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c index f32ae13e06793..c2064a8fece48 100644 --- a/Zend/zend_opcode.c +++ b/Zend/zend_opcode.c @@ -981,6 +981,38 @@ static void zend_calc_live_ranges( /* OP_DATA is really part of the previous opcode. */ last_use[var_num] = opnum - (opline->opcode == ZEND_OP_DATA); } + } else if (opline->opcode == ZEND_FE_FREE + && opline->extended_value & ZEND_FREE_ON_RETURN + && opnum + 1 < op_array->last + && ((opline + 1)->opcode == ZEND_RETURN + || (opline + 1)->opcode == ZEND_RETURN_BY_REF + || (opline + 1)->opcode == ZEND_GENERATOR_RETURN)) { + /* FE_FREE with ZEND_FREE_ON_RETURN immediately followed by RETURN frees + * the loop variable on early return. We need to split the live range + * so GC doesn't access the freed variable after this FE_FREE. + * + * FE_FREE is included in the range only if it pertains to an early + * return. */ + uint32_t opnum_last_use = last_use[var_num]; // likely a FE_FREE + __auto_type opline_last_use = &op_array->opcodes[opnum_last_use]; + if (opline_last_use->opcode == ZEND_FE_FREE && + opline_last_use->extended_value & ZEND_FREE_ON_RETURN) { + /* another early return; we include the FE_FREE */ + emit_live_range_raw(op_array, var_num, ZEND_LIVE_LOOP, + opnum + 2, opnum_last_use + 1); + } else if (opline_last_use->opcode == ZEND_FE_FREE && + !(opline_last_use->extended_value & ZEND_FREE_ON_RETURN)) { + /* the normal return; don't include the FE_FREE */ + emit_live_range_raw(op_array, var_num, ZEND_LIVE_LOOP, + opnum + 2, opnum_last_use); + } else { + /* if the last use is not FE_FREE, include it */ + emit_live_range_raw(op_array, var_num, ZEND_LIVE_LOOP, + opnum + 2, opnum_last_use + 1); + } + + /* Update last_use so next range includes this FE_FREE */ + last_use[var_num] = opnum + 1; } } if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) { diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 039d9679848ee..f6027b3dadeac 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -8144,19 +8144,45 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY) */ const zend_live_range *range = find_live_range( &EX(func)->op_array, throw_op_num, throw_op->op1.var); - /* free op1 of the corresponding RETURN */ - for (i = throw_op_num; i < range->end; i++) { - if (EX(func)->op_array.opcodes[i].opcode == ZEND_FREE - || EX(func)->op_array.opcodes[i].opcode == ZEND_FE_FREE) { + + /* free op1 of the corresponding RETURN - must use original throw_op_num + * and first range, before any split-range skipping */ + uint32_t range_end = range->end; + for (i = throw_op_num; i < range_end; i++) { + __auto_type current_opline = EX(func)->op_array.opcodes[i]; + if (current_opline.opcode == ZEND_FREE + || current_opline.opcode == ZEND_FE_FREE) { + if (current_opline.extended_value & ZEND_FREE_ON_RETURN) { + /* if this is a split end, the ZEND_RETURN is not included + * in the range, so extend the range */ + range_end++; + } /* pass */ } else { - if (EX(func)->op_array.opcodes[i].opcode == ZEND_RETURN - && (EX(func)->op_array.opcodes[i].op1_type & (IS_VAR|IS_TMP_VAR))) { - zval_ptr_dtor(EX_VAR(EX(func)->op_array.opcodes[i].op1.var)); + if (current_opline.opcode == ZEND_RETURN + && (current_opline.op1_type & (IS_VAR|IS_TMP_VAR))) { + zval_ptr_dtor(EX_VAR(current_opline.op1.var)); } break; } } + + /* skip any split ranges to find the final range of the loop var and + * adjust throw_op_num */ + for (;;) { + if (range->end < EX(func)->op_array.last) { + __auto_type last_range_opline = EX(func)->op_array.opcodes[range->end - 1]; + if (last_range_opline.opcode == ZEND_FE_FREE && + (last_range_opline.extended_value & ZEND_FREE_ON_RETURN)) { + /* the range was split, skip to find the final range */ + throw_op_num = range->end + 1; + range = find_live_range( + &EX(func)->op_array, throw_op_num, throw_op->op1.var); + continue; + } + } + break; + } throw_op_num = range->end; } diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index d6ee850839aec..a5449e7ca0aab 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -3269,19 +3269,45 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER( */ const zend_live_range *range = find_live_range( &EX(func)->op_array, throw_op_num, throw_op->op1.var); - /* free op1 of the corresponding RETURN */ - for (i = throw_op_num; i < range->end; i++) { - if (EX(func)->op_array.opcodes[i].opcode == ZEND_FREE - || EX(func)->op_array.opcodes[i].opcode == ZEND_FE_FREE) { + + /* free op1 of the corresponding RETURN - must use original throw_op_num + * and first range, before any split-range skipping */ + uint32_t range_end = range->end; + for (i = throw_op_num; i < range_end; i++) { + __auto_type current_opline = EX(func)->op_array.opcodes[i]; + if (current_opline.opcode == ZEND_FREE + || current_opline.opcode == ZEND_FE_FREE) { + if (current_opline.extended_value & ZEND_FREE_ON_RETURN) { + /* if this is a split end, the ZEND_RETURN is not included + * in the range, so extend the range */ + range_end++; + } /* pass */ } else { - if (EX(func)->op_array.opcodes[i].opcode == ZEND_RETURN - && (EX(func)->op_array.opcodes[i].op1_type & (IS_VAR|IS_TMP_VAR))) { - zval_ptr_dtor(EX_VAR(EX(func)->op_array.opcodes[i].op1.var)); + if (current_opline.opcode == ZEND_RETURN + && (current_opline.op1_type & (IS_VAR|IS_TMP_VAR))) { + zval_ptr_dtor(EX_VAR(current_opline.op1.var)); } break; } } + + /* skip any split ranges to find the final range of the loop var and + * adjust throw_op_num */ + for (;;) { + if (range->end < EX(func)->op_array.last) { + __auto_type last_range_opline = EX(func)->op_array.opcodes[range->end - 1]; + if (last_range_opline.opcode == ZEND_FE_FREE && + (last_range_opline.extended_value & ZEND_FREE_ON_RETURN)) { + /* the range was split, skip to find the final range */ + throw_op_num = range->end + 1; + range = find_live_range( + &EX(func)->op_array, throw_op_num, throw_op->op1.var); + continue; + } + } + break; + } throw_op_num = range->end; } From aad6cc5ed8c63b63d9a530915e76795c66e530d5 Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Thu, 8 Jan 2026 14:34:57 +0100 Subject: [PATCH 2/4] Split the live-ranges of loop variables again b0af9ac7331e3efa0dcee4f43b2ba8b1e4e52f2f removed the live-range splitting of foreach variables, however it only added handling to ZEND_HANDLE_EXCEPTION. This was sort-of elegant, until it was realized in 8258b7731ba8cde929e1f3504577af0a4440cad4 that it would leak the return variable, requiring some more special handling. At some point we added live tmpvar rooting in 52cf7ab8a27ace6fbff60674d7aeecf4adec1bc8, but this did not take into account already freed loop variables, which also might happen during ZEND_RETURN, which cannot be trivially accounted for, without even more complicated handling in zend_gc_*_tmpvars() functions. This commit also proposes a simpler way of tracking the loop end in loopvar freeing ops: handle it directly during live range computation rather than during compilation, eliminating the need for opcache to handle it specifically. Further, opcache was using live_ranges in its basic block computation in the past, which it no longer does. Thus this complication is no longer necessary and this approach should be actually simpler now. Closes #20766. Signed-off-by: Bob Weinand --- Zend/Optimizer/zend_dump.c | 4 ++ Zend/tests/gc_050.phpt | 40 ++++++++++++++++++++ Zend/zend_execute.c | 24 +++++------- Zend/zend_opcode.c | 55 +++++++++++++--------------- Zend/zend_vm_def.h | 51 +++----------------------- Zend/zend_vm_execute.h | 47 ++---------------------- Zend/zend_vm_gen.php | 3 +- Zend/zend_vm_opcodes.c | 4 +- Zend/zend_vm_opcodes.h | 1 + ext/opcache/tests/opt/gh11245_2.phpt | 4 +- 10 files changed, 97 insertions(+), 136 deletions(-) create mode 100644 Zend/tests/gc_050.phpt diff --git a/Zend/Optimizer/zend_dump.c b/Zend/Optimizer/zend_dump.c index b788b652979de..3ea7624c53383 100644 --- a/Zend/Optimizer/zend_dump.c +++ b/Zend/Optimizer/zend_dump.c @@ -122,6 +122,10 @@ static void zend_dump_unused_op(const zend_op *opline, znode_op op, uint32_t fla if (op.num != (uint32_t)-1) { fprintf(stderr, " try-catch(%u)", op.num); } + } else if (ZEND_VM_OP_LOOP_END == (flags & ZEND_VM_OP_MASK)) { + if (opline->extended_value & ZEND_FREE_ON_RETURN) { + fprintf(stderr, " loop-end(%u)", op.num); + } } else if (ZEND_VM_OP_THIS == (flags & ZEND_VM_OP_MASK)) { fprintf(stderr, " THIS"); } else if (ZEND_VM_OP_NEXT == (flags & ZEND_VM_OP_MASK)) { diff --git a/Zend/tests/gc_050.phpt b/Zend/tests/gc_050.phpt new file mode 100644 index 0000000000000..0bedc7220fd43 --- /dev/null +++ b/Zend/tests/gc_050.phpt @@ -0,0 +1,40 @@ +--TEST-- +GC 050: Try/finally in foreach should create separate live ranges +--FILE-- +v = 1; + } + return new stdClass; +} + +for ($i = 0; $i < 100000; $i++) { + // Create cyclic garbage to trigger GC + $a = new stdClass; + $b = new stdClass; + $a->r = $b; + $b->r = $a; + + $r = f($i % 2 + 1); +} +echo "OK\n"; +?> +--EXPECT-- +OK diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index c2d4e57c02db6..ea5f55cf6ef78 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -4673,20 +4673,6 @@ static void cleanup_unfinished_calls(zend_execute_data *execute_data, uint32_t o } /* }}} */ -static const zend_live_range *find_live_range(const zend_op_array *op_array, uint32_t op_num, uint32_t var_num) /* {{{ */ -{ - int i; - for (i = 0; i < op_array->last_live_range; i++) { - const zend_live_range *range = &op_array->live_range[i]; - if (op_num >= range->start && op_num < range->end - && var_num == (range->var & ~ZEND_LIVE_MASK)) { - return range; - } - } - return NULL; -} -/* }}} */ - static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */ { int i; @@ -4702,6 +4688,16 @@ static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t var_num = range->var & ~ZEND_LIVE_MASK; zval *var = EX_VAR(var_num); + /* Handle the split range for loop vars */ + if (catch_op_num) { + zend_op *final_op = EX(func)->op_array.opcodes + range->end; + if (final_op->extended_value & ZEND_FREE_ON_RETURN && (final_op->opcode == ZEND_FE_FREE || final_op->opcode == ZEND_FREE)) { + if (catch_op_num < range->end + final_op->op2.num) { + continue; + } + } + } + if (kind == ZEND_LIVE_TMPVAR) { zval_ptr_dtor_nogc(var); } else if (kind == ZEND_LIVE_NEW) { diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c index c2064a8fece48..7a364dfccbcdd 100644 --- a/Zend/zend_opcode.c +++ b/Zend/zend_opcode.c @@ -981,38 +981,35 @@ static void zend_calc_live_ranges( /* OP_DATA is really part of the previous opcode. */ last_use[var_num] = opnum - (opline->opcode == ZEND_OP_DATA); } - } else if (opline->opcode == ZEND_FE_FREE - && opline->extended_value & ZEND_FREE_ON_RETURN - && opnum + 1 < op_array->last - && ((opline + 1)->opcode == ZEND_RETURN - || (opline + 1)->opcode == ZEND_RETURN_BY_REF - || (opline + 1)->opcode == ZEND_GENERATOR_RETURN)) { - /* FE_FREE with ZEND_FREE_ON_RETURN immediately followed by RETURN frees + } else if ((opline->opcode == ZEND_FREE || opline->opcode == ZEND_FE_FREE) && opline->extended_value & ZEND_FREE_ON_RETURN) { + int jump_offset = 1; + while (((opline + jump_offset)->opcode == ZEND_FREE || (opline + jump_offset)->opcode == ZEND_FE_FREE) + && (opline + jump_offset)->extended_value & ZEND_FREE_ON_RETURN) { + ++jump_offset; + } + // loop var frees directly precede the jump (or return) operand, except that ZEND_VERIFY_RETURN_TYPE may happen first. + if ((opline + jump_offset)->opcode == ZEND_VERIFY_RETURN_TYPE) { + ++jump_offset; + } + /* FREE with ZEND_FREE_ON_RETURN immediately followed by RETURN frees * the loop variable on early return. We need to split the live range - * so GC doesn't access the freed variable after this FE_FREE. - * - * FE_FREE is included in the range only if it pertains to an early - * return. */ - uint32_t opnum_last_use = last_use[var_num]; // likely a FE_FREE - __auto_type opline_last_use = &op_array->opcodes[opnum_last_use]; - if (opline_last_use->opcode == ZEND_FE_FREE && - opline_last_use->extended_value & ZEND_FREE_ON_RETURN) { - /* another early return; we include the FE_FREE */ - emit_live_range_raw(op_array, var_num, ZEND_LIVE_LOOP, - opnum + 2, opnum_last_use + 1); - } else if (opline_last_use->opcode == ZEND_FE_FREE && - !(opline_last_use->extended_value & ZEND_FREE_ON_RETURN)) { - /* the normal return; don't include the FE_FREE */ - emit_live_range_raw(op_array, var_num, ZEND_LIVE_LOOP, - opnum + 2, opnum_last_use); - } else { - /* if the last use is not FE_FREE, include it */ - emit_live_range_raw(op_array, var_num, ZEND_LIVE_LOOP, - opnum + 2, opnum_last_use + 1); + * so GC doesn't access the freed variable after this FREE. */ + uint32_t opnum_last_use = last_use[var_num]; + zend_op *opline_last_use = op_array->opcodes + opnum_last_use; + ZEND_ASSERT(opline_last_use->opcode == opline->opcode); // any ZEND_FREE_ON_RETURN must be followed by a FREE without + if (opnum + jump_offset + 1 != opnum_last_use) { + emit_live_range_raw(op_array, var_num, opline->opcode == ZEND_FE_FREE ? ZEND_LIVE_LOOP : ZEND_LIVE_TMPVAR, + opnum + jump_offset + 1, opnum_last_use); } - /* Update last_use so next range includes this FE_FREE */ - last_use[var_num] = opnum + 1; + /* Update last_use so next range includes this FREE */ + last_use[var_num] = opnum; + + /* Store opline offset to loop end */ + opline->op2.opline_num = opnum_last_use - opnum; + if (opline_last_use->extended_value & ZEND_FREE_ON_RETURN) { + opline->op2.opline_num += opline_last_use->op2.opline_num; + } } } if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) { diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index f6027b3dadeac..1f06eab120d39 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -3193,7 +3193,7 @@ ZEND_VM_COLD_CONST_HANDLER(47, ZEND_JMPNZ_EX, CONST|TMPVAR|CV, JMP_ADDR) ZEND_VM_JMP(opline); } -ZEND_VM_HANDLER(70, ZEND_FREE, TMPVAR, ANY) +ZEND_VM_HANDLER(70, ZEND_FREE, TMPVAR, LOOP_END) { USE_OPLINE @@ -3202,7 +3202,7 @@ ZEND_VM_HANDLER(70, ZEND_FREE, TMPVAR, ANY) ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); } -ZEND_VM_HOT_HANDLER(127, ZEND_FE_FREE, TMPVAR, ANY) +ZEND_VM_HOT_HANDLER(127, ZEND_FE_FREE, TMPVAR, LOOP_END) { zval *var; USE_OPLINE @@ -8140,50 +8140,11 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY) && throw_op->extended_value & ZEND_FREE_ON_RETURN) { /* exceptions thrown because of loop var destruction on return/break/... * are logically thrown at the end of the foreach loop, so adjust the - * throw_op_num. + * throw_op_num to the final loop variable FREE. */ - const zend_live_range *range = find_live_range( - &EX(func)->op_array, throw_op_num, throw_op->op1.var); - - /* free op1 of the corresponding RETURN - must use original throw_op_num - * and first range, before any split-range skipping */ - uint32_t range_end = range->end; - for (i = throw_op_num; i < range_end; i++) { - __auto_type current_opline = EX(func)->op_array.opcodes[i]; - if (current_opline.opcode == ZEND_FREE - || current_opline.opcode == ZEND_FE_FREE) { - if (current_opline.extended_value & ZEND_FREE_ON_RETURN) { - /* if this is a split end, the ZEND_RETURN is not included - * in the range, so extend the range */ - range_end++; - } - /* pass */ - } else { - if (current_opline.opcode == ZEND_RETURN - && (current_opline.op1_type & (IS_VAR|IS_TMP_VAR))) { - zval_ptr_dtor(EX_VAR(current_opline.op1.var)); - } - break; - } - } - - /* skip any split ranges to find the final range of the loop var and - * adjust throw_op_num */ - for (;;) { - if (range->end < EX(func)->op_array.last) { - __auto_type last_range_opline = EX(func)->op_array.opcodes[range->end - 1]; - if (last_range_opline.opcode == ZEND_FE_FREE && - (last_range_opline.extended_value & ZEND_FREE_ON_RETURN)) { - /* the range was split, skip to find the final range */ - throw_op_num = range->end + 1; - range = find_live_range( - &EX(func)->op_array, throw_op_num, throw_op->op1.var); - continue; - } - } - break; - } - throw_op_num = range->end; + uint32_t new_throw_op_num = throw_op_num + throw_op->op2.opline_num; + cleanup_live_vars(execute_data, throw_op_num, new_throw_op_num); + throw_op_num = new_throw_op_num; } /* Find the innermost try/catch/finally the exception was thrown in */ diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index a5449e7ca0aab..fdef3e3a1b74e 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -3265,50 +3265,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER( && throw_op->extended_value & ZEND_FREE_ON_RETURN) { /* exceptions thrown because of loop var destruction on return/break/... * are logically thrown at the end of the foreach loop, so adjust the - * throw_op_num. + * throw_op_num to the final loop variable FREE. */ - const zend_live_range *range = find_live_range( - &EX(func)->op_array, throw_op_num, throw_op->op1.var); - - /* free op1 of the corresponding RETURN - must use original throw_op_num - * and first range, before any split-range skipping */ - uint32_t range_end = range->end; - for (i = throw_op_num; i < range_end; i++) { - __auto_type current_opline = EX(func)->op_array.opcodes[i]; - if (current_opline.opcode == ZEND_FREE - || current_opline.opcode == ZEND_FE_FREE) { - if (current_opline.extended_value & ZEND_FREE_ON_RETURN) { - /* if this is a split end, the ZEND_RETURN is not included - * in the range, so extend the range */ - range_end++; - } - /* pass */ - } else { - if (current_opline.opcode == ZEND_RETURN - && (current_opline.op1_type & (IS_VAR|IS_TMP_VAR))) { - zval_ptr_dtor(EX_VAR(current_opline.op1.var)); - } - break; - } - } - - /* skip any split ranges to find the final range of the loop var and - * adjust throw_op_num */ - for (;;) { - if (range->end < EX(func)->op_array.last) { - __auto_type last_range_opline = EX(func)->op_array.opcodes[range->end - 1]; - if (last_range_opline.opcode == ZEND_FE_FREE && - (last_range_opline.extended_value & ZEND_FREE_ON_RETURN)) { - /* the range was split, skip to find the final range */ - throw_op_num = range->end + 1; - range = find_live_range( - &EX(func)->op_array, throw_op_num, throw_op->op1.var); - continue; - } - } - break; - } - throw_op_num = range->end; + uint32_t new_throw_op_num = throw_op_num + throw_op->op2.opline_num; + cleanup_live_vars(execute_data, throw_op_num, new_throw_op_num); + throw_op_num = new_throw_op_num; } /* Find the innermost try/catch/finally the exception was thrown in */ diff --git a/Zend/zend_vm_gen.php b/Zend/zend_vm_gen.php index 8c178aba04ce1..5f1a44efae3a9 100755 --- a/Zend/zend_vm_gen.php +++ b/Zend/zend_vm_gen.php @@ -63,7 +63,7 @@ "ZEND_VM_OP_NUM" => 0x10, "ZEND_VM_OP_JMP_ADDR" => 0x20, "ZEND_VM_OP_TRY_CATCH" => 0x30, - // unused 0x40 + "ZEND_VM_OP_LOOP_END" => 0x40, "ZEND_VM_OP_THIS" => 0x50, "ZEND_VM_OP_NEXT" => 0x60, "ZEND_VM_OP_CLASS_FETCH" => 0x70, @@ -111,6 +111,7 @@ "NUM" => ZEND_VM_OP_NUM, "JMP_ADDR" => ZEND_VM_OP_JMP_ADDR, "TRY_CATCH" => ZEND_VM_OP_TRY_CATCH, + "LOOP_END" => ZEND_VM_OP_LOOP_END, "THIS" => ZEND_VM_OP_THIS, "NEXT" => ZEND_VM_OP_NEXT, "CLASS_FETCH" => ZEND_VM_OP_CLASS_FETCH, diff --git a/Zend/zend_vm_opcodes.c b/Zend/zend_vm_opcodes.c index 202dfd3f734f3..2d57da5d06f15 100644 --- a/Zend/zend_vm_opcodes.c +++ b/Zend/zend_vm_opcodes.c @@ -306,7 +306,7 @@ static uint32_t zend_vm_opcodes_flags[210] = { 0x00001301, 0x0100a173, 0x01040300, - 0x00000005, + 0x00004005, 0x00186703, 0x00106703, 0x08000007, @@ -363,7 +363,7 @@ static uint32_t zend_vm_opcodes_flags[210] = { 0x0000a103, 0x00002003, 0x03000001, - 0x00000005, + 0x00004005, 0x01000700, 0x00000000, 0x00000000, diff --git a/Zend/zend_vm_opcodes.h b/Zend/zend_vm_opcodes.h index d472b5b9660f5..9e56910c14455 100644 --- a/Zend/zend_vm_opcodes.h +++ b/Zend/zend_vm_opcodes.h @@ -48,6 +48,7 @@ #define ZEND_VM_OP_NUM 0x00000010 #define ZEND_VM_OP_JMP_ADDR 0x00000020 #define ZEND_VM_OP_TRY_CATCH 0x00000030 +#define ZEND_VM_OP_LOOP_END 0x00000040 #define ZEND_VM_OP_THIS 0x00000050 #define ZEND_VM_OP_NEXT 0x00000060 #define ZEND_VM_OP_CLASS_FETCH 0x00000070 diff --git a/ext/opcache/tests/opt/gh11245_2.phpt b/ext/opcache/tests/opt/gh11245_2.phpt index f42da12c52743..f17ba17162daa 100644 --- a/ext/opcache/tests/opt/gh11245_2.phpt +++ b/ext/opcache/tests/opt/gh11245_2.phpt @@ -28,9 +28,9 @@ $_main: 0000 T1 = PRE_INC_STATIC_PROP string("prop") string("X") 0001 T2 = ISSET_ISEMPTY_CV (empty) CV0($xx) 0002 JMPZ T2 0005 -0003 FREE T1 +0003 FREE T1 loop-end(2) 0004 RETURN null 0005 FREE T1 0006 RETURN int(1) LIVE RANGES: - 1: 0001 - 0005 (tmp/var) + 1: 0001 - 0003 (tmp/var) From 3a0e097376afc3c2e3d55891d8beb7eb65195abb Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Fri, 9 Jan 2026 14:08:42 +0100 Subject: [PATCH 3/4] Loop-end with + Signed-off-by: Bob Weinand --- Zend/Optimizer/zend_dump.c | 2 +- ext/opcache/tests/opt/gh11245_2.phpt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Zend/Optimizer/zend_dump.c b/Zend/Optimizer/zend_dump.c index 3ea7624c53383..5b61280d48056 100644 --- a/Zend/Optimizer/zend_dump.c +++ b/Zend/Optimizer/zend_dump.c @@ -124,7 +124,7 @@ static void zend_dump_unused_op(const zend_op *opline, znode_op op, uint32_t fla } } else if (ZEND_VM_OP_LOOP_END == (flags & ZEND_VM_OP_MASK)) { if (opline->extended_value & ZEND_FREE_ON_RETURN) { - fprintf(stderr, " loop-end(%u)", op.num); + fprintf(stderr, " loop-end(+%u)", op.num); } } else if (ZEND_VM_OP_THIS == (flags & ZEND_VM_OP_MASK)) { fprintf(stderr, " THIS"); diff --git a/ext/opcache/tests/opt/gh11245_2.phpt b/ext/opcache/tests/opt/gh11245_2.phpt index f17ba17162daa..cd5b0bd363b62 100644 --- a/ext/opcache/tests/opt/gh11245_2.phpt +++ b/ext/opcache/tests/opt/gh11245_2.phpt @@ -28,7 +28,7 @@ $_main: 0000 T1 = PRE_INC_STATIC_PROP string("prop") string("X") 0001 T2 = ISSET_ISEMPTY_CV (empty) CV0($xx) 0002 JMPZ T2 0005 -0003 FREE T1 loop-end(2) +0003 FREE T1 loop-end(+2) 0004 RETURN null 0005 FREE T1 0006 RETURN int(1) From 83ba4fc6fb46d19b7ab9ef778770ad88f6b7d137 Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Thu, 15 Jan 2026 16:12:53 +0100 Subject: [PATCH 4/4] Add NEWS Signed-off-by: Bob Weinand --- NEWS | 1 + 1 file changed, 1 insertion(+) diff --git a/NEWS b/NEWS index 20d66b445e4da..0c4c5da48b43e 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,7 @@ PHP NEWS . Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov) . Fixed bug GH-GH-20914 (Internal enums can be cloned and compared). (Arnaud) . Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov) + . Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction). (Bob) - Date: . Update timelib to 2022.16. (Derick)