Bug #70863 [NEW]: Incorect logic to increment_function for proxy objects

From: jsoumelidis at gmail dot com Operating system: Windows PHP version: 7.0.0RC6 Package: Reproducible crash Bug Type: Bug Bug description:Incorect logic to increment_function for proxy objects Description: ------------ Assume you have a (custom) proxy object that one wants to increment it's value ($obj++). If get/set object handlers are defined for this object, the "increment_function" requests a zval* from the get handler in order to icrement it's value and assign it back to the proxy object through the set handler. The problem is that the increment_function executes a Z_ADDREF_P on the returned zval* from the get handler which crashes the proccess in case the returned pointer is not a refcounted zval. File: zend_operators.c Line: 2280 -- Edit bug report at https://bugs.php.net/bug.php?id=70863&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70863&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70863&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70863&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70863&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70863&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70863&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70863&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70863&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70863&r=support Expected behavior: https://bugs.php.net/fix.php?id=70863&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70863&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70863&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70863&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70863&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70863&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70863&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70863&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70863&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70863&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70863&r=mysqlcfg