Re: com php-src: Fixed bug #68370 ("unset($this)" can make the program crash): NEWS Zend/tests/bug68370.phpt Zend/zend_execute_API.c

Hey Stas: On Mon, Nov 10, 2014 at 1:46 PM, Xinchen Hui <laruence@php.net> wrote: > Commit: ab849392549c41fd3fc3d6ed2a324688f2afe47d > Author: Xinchen Hui <laruence@php.net> Mon, 10 Nov 2014 13:46:47 +0800 > Parents: 551593707384364705cd954a52c6e4089805f0ef > Branches: PHP-5.6 master > > Link: > http://git.php.net/?p=php-src.git;a=commitdiff;h=ab849392549c41fd3fc3d6ed2a324688f2afe47d > > Log: > Fixed bug #68370 ("unset($this)" can make the program crash) > > Bugs: > https://bugs.php.net/68370 > > Changed paths: > M NEWS > A Zend/tests/bug68370.phpt > M Zend/zend_execute_API.c > > > Diff: > diff --git a/NEWS b/NEWS > index 9e5e138..79a2b88 100644 > --- a/NEWS > +++ b/NEWS > @@ -6,6 +6,7 @@ PHP NEWS > ?? ??? 2014, PHP 5.5.19 > > - Core: > + . Fixed bug #68370 ("unset($this)" can make the program crash). (Laruence) FYI: this is also segfault in 5.4, please backport it if you think it's worthy to fix. thanks > . Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in > php_getopt()). (Stas) > . Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined). > (Nikita) > diff --git a/Zend/tests/bug68370.phpt b/Zend/tests/bug68370.phpt > new file mode 100644 > index 0000000..25589bf > --- /dev/null > +++ b/Zend/tests/bug68370.phpt > @@ -0,0 +1,18 @@ > +--TEST-- > +Bug #68370 "unset($this)" can make the program crash > +--FILE-- > +<?php > +class C { > + public function test() { > + unset($this); > + return get_defined_vars(); > + } > +} > +$c = new C(); > +$x = $c->test(); > +print_r($x); > +unset($c, $x); > +--EXPECTF-- > +Array > +( > +) > diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c > index 7e2a337..9d4eebf 100644 > --- a/Zend/zend_execute_API.c > +++ b/Zend/zend_execute_API.c > @@ -1761,13 +1761,6 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */ > /*printf("Cache miss! Initialized %x\n", > EG(active_symbol_table));*/ > } > ex->symbol_table = EG(active_symbol_table); > - > - if (ex->op_array->this_var != -1 && > - !*EX_CV_NUM(ex, ex->op_array->this_var) && > - EG(This)) { > - *EX_CV_NUM(ex, ex->op_array->this_var) = > (zval**)EX_CV_NUM(ex, ex->op_array->last_var + ex->op_array->this_var); > - **EX_CV_NUM(ex, ex->op_array->this_var) = EG(This); > - } > for (i = 0; i < ex->op_array->last_var; i++) { > if (*EX_CV_NUM(ex, i)) { > zend_hash_quick_update(EG(active_symbol_table), > > > -- > PHP CVS Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > -- Xinchen Hui @Laruence http://www.laruence.com/