com php-src: Fix leak for compound shift self-assign error cases: Zend/tests/compound_shift_string_error.phpt Zend/zend _operators.c

Commit: 98c2ceacf81116065028cb18a918adafe7a38ee2 Author: Nikita Popov <nikic@php.net> Wed, 7 Jan 2015 23:13:09 +0100 Parents: 8c9415e5d762202a560de9fe7a3fd640f2a966a3 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=98c2ceacf81116065028cb18a918adafe7a38ee2 Log: Fix leak for compound shift self-assign error cases Changed paths: A Zend/tests/compound_shift_string_error.phpt M Zend/zend_operators.c Diff: diff --git a/Zend/tests/compound_shift_string_error.phpt b/Zend/tests/compound_shift_string_error.phpt new file mode 100644 index 0000000..7f01962 --- /dev/null +++ b/Zend/tests/compound_shift_string_error.phpt @@ -0,0 +1,31 @@ +--TEST-- +Error cases of compound shift assignment on strings +--FILE-- +<?php + +$n = "65"; +$n <<= $n; +var_dump($n); + +$n = "-1"; +$n <<= $n; +var_dump($n); + +$n = "65"; +$n >>= $n; +var_dump($n); + +$n = "-1"; +$n >>= $n; +var_dump($n); + +?> +--EXPECTF-- +int(0) + +Warning: Bit shift by negative number in %s on line %d +bool(false) +int(0) + +Warning: Bit shift by negative number in %s on line %d +bool(false) diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c index 14a8512..31d92c4 100644 --- a/Zend/zend_operators.c +++ b/Zend/zend_operators.c @@ -1451,6 +1451,10 @@ ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2) /* {{{ */ convert_op1_op2_long(op1, op1_lval, op2, op2_lval, ZEND_SL, shift_left_function); + if (op1 == result) { + zval_dtor(result); + } + /* prevent wrapping quirkiness on some processors where << 64 + x == << x */ if (UNEXPECTED((zend_ulong)op2_lval >= SIZEOF_ZEND_LONG * 8)) { if (EXPECTED(op2_lval > 0)) { @@ -1463,9 +1467,6 @@ ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2) /* {{{ */ } } - if (op1 == result) { - zval_dtor(result); - } ZVAL_LONG(result, op1_lval << op2_lval); return SUCCESS; } @@ -1477,6 +1478,10 @@ ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2) /* {{{ */ convert_op1_op2_long(op1, op1_lval, op2, op2_lval, ZEND_SR, shift_right_function); + if (op1 == result) { + zval_dtor(result); + } + /* prevent wrapping quirkiness on some processors where >> 64 + x == >> x */ if (UNEXPECTED((zend_ulong)op2_lval >= SIZEOF_ZEND_LONG * 8)) { if (EXPECTED(op2_lval > 0)) { @@ -1489,9 +1494,6 @@ ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2) /* {{{ */ } } - if (op1 == result) { - zval_dtor(result); - } ZVAL_LONG(result, op1_lval >> op2_lval); return SUCCESS; }