com php-src: Fixed bug #68370 ("unset($this)" can make the program crash): NEWS Zend/tests/bug68370.phpt Zend/zend_execute_API.c

Commit: ab849392549c41fd3fc3d6ed2a324688f2afe47d Author: Xinchen Hui <laruence@php.net> Mon, 10 Nov 2014 13:46:47 +0800 Parents: 551593707384364705cd954a52c6e4089805f0ef Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=ab849392549c41fd3fc3d6ed2a324688f2afe47d Log: Fixed bug #68370 ("unset($this)" can make the program crash) Bugs: https://bugs.php.net/68370 Changed paths: M NEWS A Zend/tests/bug68370.phpt M Zend/zend_execute_API.c Diff: diff --git a/NEWS b/NEWS index 9e5e138..79a2b88 100644 --- a/NEWS +++ b/NEWS @@ -6,6 +6,7 @@ PHP NEWS ?? ??? 2014, PHP 5.5.19 - Core: + . Fixed bug #68370 ("unset($this)" can make the program crash). (Laruence) . Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in php_getopt()). (Stas) . Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita) diff --git a/Zend/tests/bug68370.phpt b/Zend/tests/bug68370.phpt new file mode 100644 index 0000000..25589bf --- /dev/null +++ b/Zend/tests/bug68370.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #68370 "unset($this)" can make the program crash +--FILE-- +<?php +class C { + public function test() { + unset($this); + return get_defined_vars(); + } +} +$c = new C(); +$x = $c->test(); +print_r($x); +unset($c, $x); +--EXPECTF-- +Array +( +) diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 7e2a337..9d4eebf 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -1761,13 +1761,6 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */ /*printf("Cache miss! Initialized %x\n", EG(active_symbol_table));*/ } ex->symbol_table = EG(active_symbol_table); - - if (ex->op_array->this_var != -1 && - !*EX_CV_NUM(ex, ex->op_array->this_var) && - EG(This)) { - *EX_CV_NUM(ex, ex->op_array->this_var) = (zval**)EX_CV_NUM(ex, ex->op_array->last_var + ex->op_array->this_var); - **EX_CV_NUM(ex, ex->op_array->this_var) = EG(This); - } for (i = 0; i < ex->op_array->last_var; i++) { if (*EX_CV_NUM(ex, i)) { zend_hash_quick_update(EG(active_symbol_table),