com php-src: Fixed bug #72911 (Memleak in zend_binary_assi gn_op_obj_helper): NEWS Zend/tests/bug729 11.phpt Zend/zend_execute.c

Commit: 0476bb1de54896b6c062125f22318533998ce94a Author: Xinchen Hui <laruence@gmail.com> Sun, 21 Aug 2016 17:38:03 +0800 Parents: 17e8a3df134fe042b12cf0482fa578fb61f02cb2 Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=0476bb1de54896b6c062125f22318533998ce94a Log: Fixed bug #72911 (Memleak in zend_binary_assign_op_obj_helper) Bugs: https://bugs.php.net/72911 Changed paths: M NEWS A Zend/tests/bug72911.phpt M Zend/zend_execute.c Diff: diff --git a/NEWS b/NEWS index 2726658..ebc273c 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,7 @@ PHP NEWS ?? ??? 2016 PHP 7.0.11 - Core: + . Fixed bug #72911 (Memleak in zend_binary_assign_op_obj_helper). (Laruence) . Fixed bug #72813 (Segfault with __get returned by ref). (Laruence) . Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator). (Nikita) diff --git a/Zend/tests/bug72911.phpt b/Zend/tests/bug72911.phpt new file mode 100644 index 0000000..098261c --- /dev/null +++ b/Zend/tests/bug72911..phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #72911 (Memleak in zend_binary_assign_op_obj_helper) +--FILE-- +<?php + +$a = 0; + +$b = $a->b->i -= 0; + +var_dump($b); + +?> +--EXPECTF-- +Warning: Attempt to modify property of non-object in %sbug72911.php on line %d + +Warning: Attempt to assign property of non-object in %sbug72911.php on line %d +NULL diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index a2ef9c3..9a3f69e 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -595,7 +595,9 @@ static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *v static inline int make_real_object(zval *object) { if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) { - if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE)) { + if (UNEXPECTED(object == &EG(error_zval))) { + return 0; + } else if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE)) { /* nothing to destroy */ } else if (EXPECTED((Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0))) { zval_ptr_dtor_nogc(object);