com php-src: Fixed bug #70288 (Apache crash related to ZEND_SEND_REF): NEWS Zend/tests/bug70288 .phpt Zend/zend_vm_def.h Zend/zend_vm_execute .h

Commit: e543769fa44fada6883537ab6684a993f45de3d9 Author: Xinchen Hui <laruence@php.net> Tue, 18 Aug 2015 21:45:19 +0800 Parents: 34834c58fac070fe9fd8b0e595f6fad7993a3c68 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=e543769fa44fada6883537ab6684a993f45de3d9 Log: Fixed bug #70288 (Apache crash related to ZEND_SEND_REF) Bugs: https://bugs.php.net/70288 Changed paths: M NEWS A Zend/tests/bug70288.phpt M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index 5aeccc8..fc67894 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,7 @@ PHP NEWS 20 Aug 2015, PHP 7.0.0 RC 1 - Core: + . Fixed bug #70288 (Apache crash related to ZEND_SEND_REF). (Laruence) . Fixed bug #70262 (Accessing array crashes PHP 7.0beta3). (Laruence, Dmitry) . Fixed bug #70258 (Segfault if do_resize fails to allocated memory). diff --git a/Zend/tests/bug70288.phpt b/Zend/tests/bug70288.phpt new file mode 100644 index 0000000..4b55d0b --- /dev/null +++ b/Zend/tests/bug70288.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #70288 (Apache crash related to ZEND_SEND_REF) +--FILE-- +<?php +class A { + public function __get($name) { + return new Stdclass(); + } +} + +function test(&$obj) { + var_dump($obj); +} +$a = new A; +test($a->dummy); +?> +--EXPECTF-- +object(stdClass)#%d (0) { +} diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index eceed13..f4afd52 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -4301,9 +4301,6 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY) if (Z_ISREF_P(varptr)) { Z_ADDREF_P(varptr); ZVAL_COPY_VALUE(arg, varptr); - } else if (OP1_TYPE == IS_VAR && - UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) { - ZVAL_NEW_REF(arg, varptr); } else { ZVAL_NEW_REF(arg, varptr); Z_ADDREF_P(arg); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index cf1c7a1...043dc32 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute..h @@ -15270,9 +15270,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND if (Z_ISREF_P(varptr)) { Z_ADDREF_P(varptr); ZVAL_COPY_VALUE(arg, varptr); - } else if (IS_VAR == IS_VAR && - UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) { - ZVAL_NEW_REF(arg, varptr); } else { ZVAL_NEW_REF(arg, varptr); Z_ADDREF_P(arg); @@ -28658,9 +28655,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_ if (Z_ISREF_P(varptr)) { Z_ADDREF_P(varptr); ZVAL_COPY_VALUE(arg, varptr); - } else if (IS_CV == IS_VAR && - UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) { - ZVAL_NEW_REF(arg, varptr); } else { ZVAL_NEW_REF(arg, varptr); Z_ADDREF_P(arg);