Fix OSS Fuzz #60734: use-after-free visible in ASAN build

Author: Girgias

Zend/tests/in-de-crement/object_cannot_incdec.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Cannot increment/decrement objects
+--FILE--
+<?php
+class Foo { }
+$o = new Foo;
+
+try {
+    $o++;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $o--;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    ++$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    --$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+?>
+--EXPECT--
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}

Zend/tests/in-de-crement/object_cannot_incdec_use_result_op.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Cannot increment/decrement objects
+--FILE--
+<?php
+class Foo { }
+$o = new Foo;
+
+try {
+    $y = $o++;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $y = $o--;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $y = ++$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+try {
+    $y = --$o;
+} catch (\TypeError $e) {
+    echo $e->getMessage(), PHP_EOL;
+    var_dump($o);
+}
+?>
+--EXPECT--
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}
+Cannot increment Foo
+object(Foo)#1 (0) {
+}
+Cannot decrement Foo
+object(Foo)#1 (0) {
+}

Zend/tests/in-de-crement/oss-fuzz-60734_predec-object.phpt

@@ -0,0 +1,14 @@
+--TEST--
+OSS Fuzz #60734: use-after-free visible in ASAN build pre decrement.
+--FILE--
+<?php
+class Foo{
+}
+$test = new Foo;
+$y = --$test;
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Cannot decrement Foo in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/tests/in-de-crement/oss-fuzz-60734_preinc-object.phpt

@@ -0,0 +1,14 @@
+--TEST--
+OSS Fuzz #60734: use-after-free visible in ASAN build pre increment.
+--FILE--
+<?php
+class Foo{
+}
+$test = new Foo;
+$y = ++$test;
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Cannot increment Foo in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

Zend/zend_vm_def.h

@@ -1501,6 +1501,10 @@ ZEND_VM_HELPER(zend_pre_inc_helper, VAR|CV, ANY)
 		}
 		increment_function(var_ptr);
 		if (UNEXPECTED(EG(exception))) {
+			/* Smart branch expects result to be set with exceptions */
+			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+				ZVAL_NULL(EX_VAR(opline->result.var));
+			}
 			HANDLE_EXCEPTION();
 		}
 	} while (0);
@@ -1556,6 +1560,10 @@ ZEND_VM_HELPER(zend_pre_dec_helper, VAR|CV, ANY)
 		}
 		decrement_function(var_ptr);
 		if (UNEXPECTED(EG(exception))) {
+			/* Smart branch expects result to be set with exceptions */
+			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+				ZVAL_NULL(EX_VAR(opline->result.var));
+			}
 			HANDLE_EXCEPTION();
 		}
 	} while (0);