com php-src: Fixed bug #70262 (Accessing array crashes PHP 7.0beta3): NEWS Zend/tests/bug70262.phpt Zend/zend_vm_def.h Zend/zend _vm_execute.h

Commit: ce89fd9758fffd6c4bffca130829734ac3fca8ec Author: Dmitry Stogov <dmitry@zend.com> Mon, 17 Aug 2015 12:58:14 +0300 Parents: 2d475eb943a2da6f55ea51e1979c31d22606c692 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=ce89fd9758fffd6c4bffca130829734ac3fca8ec Log: Fixed bug #70262 (Accessing array crashes PHP 7.0beta3) Bugs: https://bugs.php.net/70262 Changed paths: M NEWS A Zend/tests/bug70262.phpt M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index 5044144..4bf047c 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,8 @@ PHP NEWS 20 Aug 2015, PHP 7.0.0 RC 1 - Core: + . Fixed bug #70262 (Accessing array crashes PHP 7.0beta3). + (Laruence, Dmitry) . Fixed bug #70258 (Segfault if do_resize fails to allocated memory). (Laruence) . Fixed bug #70253 (segfault at _efree () in zend_alloc.c:1389). (Laruence) diff --git a/Zend/tests/bug70262.phpt b/Zend/tests/bug70262.phpt new file mode 100644 index 0000000..42e7fe0 --- /dev/null +++ b/Zend/tests/bug70262.phpt @@ -0,0 +1,34 @@ +--TEST-- +Bug #70262 (Accessing array crashes) +--FILE-- +<?php +class C { + public $arguments; + public function __construct($arg) { + $this->arguments = $arg; + } +} + +function & a(&$arg) { + $c = new C($arg); + $arg[] = $c; + return $c; +} + +function c($arr) { + a($arr)->arguments[0] = "bad"; +} + +$arr = array(); +$arr[] = "foo"; +$arr[] = "bar"; +c($arr); +var_dump($arr); +?> +--EXPECT-- +array(2) { + [0]=> + string(3) "foo" + [1]=> + string(3) "bar" +} diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index eceed13..9ee27d8 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -7250,11 +7250,11 @@ ZEND_VM_HANDLER(156, ZEND_SEPARATE, VAR, UNUSED) zval *var_ptr; var_ptr = EX_VAR(opline->op1.var); - if (Z_TYPE_P(var_ptr) != IS_OBJECT && - !Z_ISREF_P(var_ptr) && - Z_REFCOUNTED_P(var_ptr) && - Z_REFCOUNT_P(var_ptr) > 1) { - + if (UNEXPECTED(Z_ISREF_P(var_ptr))) { + if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) { + ZVAL_UNREF(var_ptr); + } + } else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) { Z_DELREF_P(var_ptr); ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr); } diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index cf1c7a1..8dd8881 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -19444,11 +19444,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDL zval *var_ptr; var_ptr = EX_VAR(opline->op1.var); - if (Z_TYPE_P(var_ptr) != IS_OBJECT && - !Z_ISREF_P(var_ptr) && - Z_REFCOUNTED_P(var_ptr) && - Z_REFCOUNT_P(var_ptr) > 1) { - + if (UNEXPECTED(Z_ISREF_P(var_ptr))) { + if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) { + ZVAL_UNREF(var_ptr); + } + } else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) { Z_DELREF_P(var_ptr); ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr); }