Fix free of uninitialized memory in MATCH_ERROR

iluuu1994 · iluuu1994 · commit 0f8aca11f747 · 2020-07-11T18:50:45.000+02:00
As suggested by Tyson Andre: php#5371 (comment) Also fix line number of unhandled match error
diff --git a/Zend/tests/match/037.phpt b/Zend/tests/match/037.phpt
@@ -52,13 +52,13 @@ var_dump(match(3) {
 });
 
 --EXPECTF--
-string(%d) "UnhandledMatchError: Unhandled match value of type bool in %s037.php:5
+string(%d) "UnhandledMatchError: Unhandled match value of type bool in %s037.php:4
 Stack trace:
 #0 {main}"
-string(%d) "UnhandledMatchError: Unhandled match value of type int in %s037.php:13
+string(%d) "UnhandledMatchError: Unhandled match value of type int in %s037.php:12
 Stack trace:
 #0 {main}"
-string(%d) "UnhandledMatchError: Unhandled match value of type string in %s037.php:21
+string(%d) "UnhandledMatchError: Unhandled match value of type string in %s037.php:20
 Stack trace:
 #0 {main}"
 string(3) "foo"
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
@@ -5297,6 +5297,23 @@ void zend_compile_match(znode *result, zend_ast *ast)
 	uint32_t cond_count = 0;
 	uint32_t *jmp_end_opnums = safe_emalloc(sizeof(uint32_t), arms->children, 0);
 
+	if (!has_default_arm) {
+		if (!uses_jumptable) {
+			zend_update_jump_target_to_next(opnum_default_jmp);
+		}
+
+		if (jumptable) {
+			zend_op *opline = &CG(active_op_array)->opcodes[opnum_match];
+			opline->extended_value = get_next_op_number();
+		}
+
+		CG(zend_lineno) = ast->lineno;
+		zend_op *opline = zend_emit_op(NULL, ZEND_MATCH_ERROR, &expr_node, NULL);
+		if (opline->op1_type == IS_CONST) {
+			Z_TRY_ADDREF_P(CT_CONSTANT(opline->op1));
+		}
+	}
+
 	for (uint32_t i = 0; i < arms->children; ++i) {
 		zend_ast *arm_ast = arms->child[i];
 		zend_ast *body_ast = arm_ast->child[1];
@@ -5358,22 +5375,6 @@ void zend_compile_match(znode *result, zend_ast *ast)
 		ZVAL_NULL(&result->u.constant);
 	}
 
-	if (!has_default_arm) {
-		if (!uses_jumptable) {
-			zend_update_jump_target_to_next(opnum_default_jmp);
-		}
-
-		if (jumptable) {
-			zend_op *opline = &CG(active_op_array)->opcodes[opnum_match];
-			opline->extended_value = get_next_op_number();
-		}
-
-		zend_op *opline = zend_emit_op(NULL, ZEND_MATCH_ERROR, &expr_node, NULL);
-		if (opline->op1_type == IS_CONST) {
-			Z_TRY_ADDREF_P(CT_CONSTANT(opline->op1));
-		}
-	}
-
 	for (uint32_t i = 0; i < arms->children; ++i) {
 		zend_update_jump_target_to_next(jmp_end_opnums[i]);
 	}
