Skip to content

Commit 1020b74

Browse files
arnaud-lbarnaud-lb
committed
Merge branch 'PHP-8.2'
* PHP-8.2: Check return value of zend_jit_trace_get_exit_addr() (#9097)
2 parents 53cefd4 + 3c852cf commit 1020b74

File tree

2 files changed

+61
-0
lines changed

2 files changed

+61
-0
lines changed

‎ext/opcache/jit/zend_jit_arm64.dasc

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2997,6 +2997,9 @@ static int zend_jit_trace_end(dasm_State **Dst, zend_jit_trace_info *t)
29972997
|.cold_code
29982998
for (i = 0; i < t->exit_count; i++) {
29992999
exit_addr = zend_jit_trace_get_exit_addr(i);
3000+
if (!exit_addr) {
3001+
return 0;
3002+
}
30003003
| b &exit_addr
30013004
}
30023005
|=>1: // end of the code
@@ -3804,6 +3807,9 @@ static int zend_jit_inc_dec(dasm_State **Dst, const zend_op *opline, uint32_t op
38043807

38053808
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
38063809
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
3810+
if (!exit_addr) {
3811+
return 0;
3812+
}
38073813
| bvs &exit_addr
38083814

38093815
if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) &&
@@ -4106,6 +4112,9 @@ static int zend_jit_math_long_long(dasm_State **Dst,
41064112
if (res_info & MAY_BE_GUARD) {
41074113
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
41084114
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
4115+
if (!exit_addr) {
4116+
return 0;
4117+
}
41094118
if ((res_info & MAY_BE_ANY) == MAY_BE_LONG) {
41104119
if (use_ovf_flag) {
41114120
| bvs &exit_addr
@@ -6314,6 +6323,9 @@ static int zend_jit_assign_dim_op(dasm_State **Dst, const zend_op *opline, uint3
63146323
&& !(op2_info & ((MAY_BE_ANY|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_STRING)))) {
63156324
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
63166325
not_found_exit_addr = zend_jit_trace_get_exit_addr(exit_point);
6326+
if (!not_found_exit_addr) {
6327+
return 0;
6328+
}
63176329
}
63186330

63196331
if (!zend_jit_fetch_dimension_address_inner(Dst, opline, BP_VAR_RW, op1_info, op2_info, dim_type, NULL, not_found_exit_addr, NULL)) {
@@ -12367,6 +12379,9 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
1236712379
&& (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_OBJECT) {
1236812380
exit_point = zend_jit_trace_get_exit_point(opline, 0);
1236912381
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
12382+
if (!exit_addr) {
12383+
return 0;
12384+
}
1237012385
} else {
1237112386
val_addr = ZEND_ADDR_MEM_ZVAL(ZREG_REG0, 0);
1237212387
| LOAD_ZVAL_ADDR REG0, prop_addr
@@ -12757,6 +12772,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1275712772
if (use_prop_guard) {
1275812773
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1275912774
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
12775+
if (!exit_addr) {
12776+
return 0;
12777+
}
1276012778

1276112779
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr, ZREG_TMP1
1276212780
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -12896,6 +12914,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1289612914
SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_DOUBLE, 0);
1289712915
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1289812916
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
12917+
if (!exit_addr) {
12918+
return 0;
12919+
}
1289912920
SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
1290012921
ssa->var_info[ssa_op->result_def].type = res_info & ~MAY_BE_GUARD;
1290112922
| b &exit_addr
@@ -13189,6 +13210,9 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
1318913210
if (use_prop_guard) {
1319013211
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1319113212
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13213+
if (!exit_addr) {
13214+
return 0;
13215+
}
1319213216

1319313217
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr, ZREG_TMP1
1319413218
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -13972,10 +13996,16 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1397213996
if (next_opline != opline + 1) {
1397313997
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1397413998
fallback_label = zend_jit_trace_get_exit_addr(exit_point);
13999+
if (!fallback_label) {
14000+
return 0;
14001+
}
1397514002
}
1397614003
if (next_opline != default_opline) {
1397714004
exit_point = zend_jit_trace_get_exit_point(default_opline, 0);
1397814005
default_label = zend_jit_trace_get_exit_addr(exit_point);
14006+
if (!default_label) {
14007+
return 0;
14008+
}
1397914009
}
1398014010
}
1398114011

‎ext/opcache/jit/zend_jit_x86.dasc

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4180,6 +4180,9 @@ static int zend_jit_inc_dec(dasm_State **Dst, const zend_op *opline, uint32_t op
41804180

41814181
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
41824182
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
4183+
if (!exit_addr) {
4184+
return 0;
4185+
}
41834186
| jo &exit_addr
41844187

41854188
if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) &&
@@ -4479,6 +4482,9 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44794482
if (res_info & MAY_BE_GUARD) {
44804483
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
44814484
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
4485+
if (!exit_addr) {
4486+
return 0;
4487+
}
44824488
if ((res_info & MAY_BE_ANY) == MAY_BE_LONG) {
44834489
| jo &exit_addr
44844490
if (Z_MODE(res_addr) == IS_REG && result_reg != Z_REG(res_addr)) {
@@ -6866,6 +6872,9 @@ static int zend_jit_assign_dim_op(dasm_State **Dst, const zend_op *opline, uint3
68666872
&& !(op2_info & ((MAY_BE_ANY|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_STRING)))) {
68676873
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
68686874
not_found_exit_addr = zend_jit_trace_get_exit_addr(exit_point);
6875+
if (!not_found_exit_addr) {
6876+
return 0;
6877+
}
68696878
}
68706879

68716880
if (!zend_jit_fetch_dimension_address_inner(Dst, opline, BP_VAR_RW, op1_info, op2_info, dim_type, NULL, not_found_exit_addr, NULL)) {
@@ -13123,6 +13132,9 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
1312313132
&& (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_OBJECT) {
1312413133
exit_point = zend_jit_trace_get_exit_point(opline, 0);
1312513134
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13135+
if (!exit_addr) {
13136+
return 0;
13137+
}
1312613138
} else {
1312713139
val_addr = ZEND_ADDR_MEM_ZVAL(ZREG_R0, 0);
1312813140
| LOAD_ZVAL_ADDR r0, prop_addr
@@ -13514,6 +13526,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1351413526
if (use_prop_guard) {
1351513527
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1351613528
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13529+
if (!exit_addr) {
13530+
return 0;
13531+
}
1351713532

1351813533
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr
1351913534
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -13672,6 +13687,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1367213687
SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_DOUBLE, 0);
1367313688
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1367413689
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13690+
if (!exit_addr) {
13691+
return 0;
13692+
}
1367513693
SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
1367613694
ssa->var_info[ssa_op->result_def].type = res_info & ~MAY_BE_GUARD;
1367713695
| jmp &exit_addr
@@ -13995,6 +14013,9 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
1399514013
if (use_prop_guard) {
1399614014
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1399714015
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
14016+
if (!exit_addr) {
14017+
return 0;
14018+
}
1399814019

1399914020
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr
1400014021
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -14695,6 +14716,10 @@ static int zend_jit_fetch_this(dasm_State **Dst, const zend_op *opline, const ze
1469514716
int32_t exit_point = zend_jit_trace_get_exit_point(opline, ZEND_JIT_EXIT_TO_VM);
1469614717
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
1469714718

14719+
if (!exit_addr) {
14720+
return 0;
14721+
}
14722+
1469814723
| cmp byte EX->This.u1.v.type, IS_OBJECT
1469914724
| jne &exit_addr
1470014725

@@ -14876,10 +14901,16 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1487614901
if (next_opline != opline + 1) {
1487714902
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1487814903
fallback_label = zend_jit_trace_get_exit_addr(exit_point);
14904+
if (!fallback_label) {
14905+
return 0;
14906+
}
1487914907
}
1488014908
if (next_opline != default_opline) {
1488114909
exit_point = zend_jit_trace_get_exit_point(default_opline, 0);
1488214910
default_label = zend_jit_trace_get_exit_addr(exit_point);
14911+
if (!default_label) {
14912+
return 0;
14913+
}
1488314914
}
1488414915
}
1488514916

0 commit comments

Comments
 (0)