cvs: Zend(PHP_4_4) / zend_compile.c zend_compile.h zend_execute.c zend_execute_globals.h zend_language_parser.y php-src NEWS

derick Mon Jun 6 05:30:10 2005 EDT Modified files: (Branch: PHP_4_4) /php-src NEWS /Zend zend_compile.c zend_compile.h zend_execute.c zend_execute_globals.h zend_language_parser.y Log: - Commit the reference problem bug fix. http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1247.2.920&r2=1.1247.2.920.2.1&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1247.2.920 php-src/NEWS:1.1247.2.920.2.1 --- php-src/NEWS:1.1247.2.920 Thu Jun 2 17:32:49 2005 +++ php-src/NEWS Mon Jun 6 05:30:09 2005 @@ -1,12 +1,14 @@ PHP 4 NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| -?? ??? 20??, Version 4.?.? +?? ??? 2005, Version 4.4.0 - Added man pages for "phpize" and "php-config" scripts. (Jakub Vrana) - Added support for .cc files in extensions. (Brian) - Added the sorting flag SORT_LOCALE_STRING to the sort() functions which makes them sort based on the current locale. (Derick) - Changed sha1_file() and md5_file() functions to use streams instead of low level IO. (Uwe) +- Fixed memory curruptions when using references in a wrong way. (Marcus, + Dmitry, Derick) - Fixed memory corruption in stristr(). (Derick) - Fixed bug #33222 (segfault when CURL handle is closed in a callback). (Tony) - Fixed bug #33214 (odbc_next_result does not signal SQL errors with http://cvs.php.net/diff.php/Zend/zend_compile.c?r1=1.240.2.10&r2=1.240.2.10.2.1&ty=u Index: Zend/zend_compile.c diff -u Zend/zend_compile.c:1.240.2.10 Zend/zend_compile.c:1.240.2.10.2.1 --- Zend/zend_compile.c:1.240.2.10 Mon Apr 25 05:58:32 2005 +++ Zend/zend_compile.c Mon Jun 6 05:30:09 2005 @@ -532,6 +532,13 @@ } +static inline zend_bool zend_is_function_or_method_call(znode *variable) +{ + zend_uint type = variable->u.EA.type; + + return (type == ZEND_PARSED_FCALL); +} + void zend_do_begin_variable_parse(TSRMLS_D) { zend_llist fetch_list; @@ -1107,6 +1114,15 @@ opline->op1.op_type = IS_CONST; INIT_ZVAL(opline->op1.u.constant); } + + if (do_end_vparse) { + if (zend_is_function_or_method_call(expr)) { + opline->extended_value = ZEND_RETURNS_FUNCTION; + } else { + opline->extended_value = 0; + } + } + SET_UNUSED(opline->op2); } http://cvs.php.net/diff.php/Zend/zend_compile.h?r1=1.144.4.6&r2=1.144.4.6.2.1&ty=u Index: Zend/zend_compile.h diff -u Zend/zend_compile.h:1.144.4.6 Zend/zend_compile.h:1.144.4.6.2.1 --- Zend/zend_compile.h:1.144.4.6 Fri Sep 24 09:15:14 2004 +++ Zend/zend_compile.h Mon Jun 6 05:30:09 2005 @@ -532,6 +532,9 @@ #define ZEND_FETCH_LOCAL 1 #define ZEND_FETCH_STATIC 2 +/* variable parsing type (compile-time) */ +#define ZEND_PARSED_FCALL (1<<0) + /* var status for backpatching */ #define BP_VAR_R 0 #define BP_VAR_W 1 @@ -615,6 +618,8 @@ #define ZEND_RETURN_VAL 0 #define ZEND_RETURN_REF 1 +#define ZEND_RETURNS_FUNCTION 1<<0 + END_EXTERN_C() #endif /* ZEND_COMPILE_H */ http://cvs.php.net/diff.php/Zend/zend_execute.c?r1=1.316.2.49&r2=1.316.2.49.2.1&ty=u Index: Zend/zend_execute.c diff -u Zend/zend_execute.c:1.316.2.49 Zend/zend_execute.c:1.316.2.49.2.1 --- Zend/zend_execute.c:1.316.2.49 Mon May 2 21:30:06 2005 +++ Zend/zend_execute.c Mon Jun 6 05:30:09 2005 @@ -1645,6 +1645,8 @@ EX(Ts)[EX(opline)->result.u.var].var.ptr_ptr = &EX(Ts)[EX(opline)->result.u.var].var.ptr; + EX(Ts)[EX(opline)->result.u.var].var.fcall_returned_reference = 0; + if (EX(function_state).function->type==ZEND_INTERNAL_FUNCTION) { ALLOC_ZVAL(EX(Ts)[EX(opline)->result.u.var].var.ptr); INIT_ZVAL(*(EX(Ts)[EX(opline)->result.u.var].var.ptr)); @@ -1696,6 +1698,7 @@ EG(active_op_array) = (zend_op_array *) EX(function_state).function; zend_execute(EG(active_op_array) TSRMLS_CC); + EX(Ts)[EX(opline)->result.u.var].var.fcall_returned_reference = EG(active_op_array)->return_reference; if (return_value_used && !EX(Ts)[EX(opline)->result.u.var].var.ptr) { ALLOC_ZVAL(EX(Ts)[EX(opline)->result.u.var].var.ptr); @@ -1737,15 +1740,28 @@ zval *retval_ptr; zval **retval_ptr_ptr; - if ((EG(active_op_array)->return_reference == ZEND_RETURN_REF) && - (EX(opline)->op1.op_type != IS_CONST) && - (EX(opline)->op1.op_type != IS_TMP_VAR)) { + if (EG(active_op_array)->return_reference == ZEND_RETURN_REF) { + if (EX(opline)->op1.op_type == IS_CONST || EX(opline)->op1.op_type == IS_TMP_VAR) { + /* Not supposed to happen, but we'll allow it */ + zend_error(E_NOTICE, "Only variable references should be returned by reference"); + goto return_by_value; + } retval_ptr_ptr = get_zval_ptr_ptr(&EX(opline)->op1, EX(Ts), BP_VAR_W); if (!retval_ptr_ptr) { zend_error(E_ERROR, "Cannot return overloaded elements or string offsets by reference"); } + + if (!(*retval_ptr_ptr)->is_ref) { + if (EX(Ts)[EX(opline)->op1.u.var].var.ptr_ptr == &EX(Ts)[EX(opline)->op1.u.var].var.ptr + || (EX(opline)->extended_value == ZEND_RETURNS_FUNCTION && !EX(Ts)[EX(opline)->op1.u.var].var.fcall_returned_reference)) { + zend_error(E_NOTICE, "Only variable references should be returned by reference"); + PZVAL_LOCK(*retval_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */ + goto return_by_value; + } + } + SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr); #if 0 /* Will be fixed in ZE2, too dangerous to touch in the context of ZE1 */ @@ -1756,6 +1772,7 @@ (*retval_ptr_ptr)->refcount++; (*EG(return_value_ptr_ptr)) = (*retval_ptr_ptr); } else { +return_by_value: retval_ptr = get_zval_ptr(&EX(opline)->op1, EX(Ts), &EG(free_op1), BP_VAR_R); if (!EG(free_op1)) { /* Not a temp var */ http://cvs.php.net/diff.php/Zend/zend_execute_globals.h?r1=1.2.2.1&r2=1.2.2.1.8.1&ty=u Index: Zend/zend_execute_globals.h diff -u Zend/zend_execute_globals.h:1.2.2.1 Zend/zend_execute_globals.h:1.2.2.1.8.1 --- Zend/zend_execute_globals.h:1.2.2.1 Tue Dec 31 11:23:00 2002 +++ Zend/zend_execute_globals.h Mon Jun 6 05:30:09 2005 @@ -31,6 +31,7 @@ struct { zval **ptr_ptr; zval *ptr; + zend_bool fcall_returned_reference; } var; struct { zval tmp_var; /* a dummy */ http://cvs.php.net/diff.php/Zend/zend_language_parser.y?r1=1.23.4.1&r2=1.23.4.1.2.1&ty=u Index: Zend/zend_language_parser.y diff -u Zend/zend_language_parser.y:1.23.4.1 Zend/zend_language_parser.y:1.23.4.1.2.1 --- Zend/zend_language_parser.y:1.23.4.1 Fri Sep 24 09:15:15 2004 +++ Zend/zend_language_parser.y Mon Jun 6 05:30:09 2005 @@ -471,7 +471,7 @@ | expr '?' { zend_do_begin_qm_op(&$1, &$2 TSRMLS_CC); } expr ':' { zend_do_qm_true(&$4, &$2, &$5 TSRMLS_CC); } expr { zend_do_qm_false(&$$, &$7, &$2, &$5 TSRMLS_CC); } - | function_call { $$ = $1; } + | function_call { $$ = $1; $$.u.EA.type = ZEND_PARSED_FCALL; } | internal_functions_in_yacc { $$ = $1; } | T_INT_CAST expr { zend_do_cast(&$$, &$2, IS_LONG TSRMLS_CC); } | T_DOUBLE_CAST expr { zend_do_cast(&$$, &$2, IS_DOUBLE TSRMLS_CC); }