com php-src: Fixed bug #70288 (Apache crash related to ZEND_SEND_REF): Zend/tests/bug70288.phpt Zend/zend_vm_def.h Zend/zend_vm_execute.h

Commit: be58583ced1d85fdc12f627d030db44854eff67c Author: Xinchen Hui <laruence@php.net> Tue, 18 Aug 2015 21:45:19 +0800 Committer: Anatol Belski <ab@php.net> Tue, 18 Aug 2015 17:19:37 +0200 Parents: 1ef817d7965d7c761789df90ac28a9be32edb84c Branches: PHP-7.0.0 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=be58583ced1d85fdc12f627d030db44854eff67c Log: Fixed bug #70288 (Apache crash related to ZEND_SEND_REF) Bugs: https://bugs.php.net/70288 Changed paths: A Zend/tests/bug70288.phpt M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/Zend/tests/bug70288.phpt b/Zend/tests/bug70288.phpt new file mode 100644 index 0000000..4b55d0b --- /dev/null +++ b/Zend/tests/bug70288.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #70288 (Apache crash related to ZEND_SEND_REF) +--FILE-- +<?php +class A { + public function __get($name) { + return new Stdclass(); + } +} + +function test(&$obj) { + var_dump($obj); +} +$a = new A; +test($a->dummy); +?> +--EXPECTF-- +object(stdClass)#%d (0) { +} diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index eceed13..f4afd52 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -4301,9 +4301,6 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY) if (Z_ISREF_P(varptr)) { Z_ADDREF_P(varptr); ZVAL_COPY_VALUE(arg, varptr); - } else if (OP1_TYPE == IS_VAR && - UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) { - ZVAL_NEW_REF(arg, varptr); } else { ZVAL_NEW_REF(arg, varptr); Z_ADDREF_P(arg); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index cf1c7a1..043dc32 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -15270,9 +15270,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND if (Z_ISREF_P(varptr)) { Z_ADDREF_P(varptr); ZVAL_COPY_VALUE(arg, varptr); - } else if (IS_VAR == IS_VAR && - UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) { - ZVAL_NEW_REF(arg, varptr); } else { ZVAL_NEW_REF(arg, varptr); Z_ADDREF_P(arg); @@ -28658,9 +28655,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_ if (Z_ISREF_P(varptr)) { Z_ADDREF_P(varptr); ZVAL_COPY_VALUE(arg, varptr); - } else if (IS_CV == IS_VAR && - UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) { - ZVAL_NEW_REF(arg, varptr); } else { ZVAL_NEW_REF(arg, varptr); Z_ADDREF_P(arg);