com php-src: Merge branch 'PHP-7.0' into PHP-7.1: Zend/zend_o perators.c

Commit: b56114e8fb90098e4f56e8bea92c8d5450a76483 Author: Xinchen Hui <laruence@gmail.com> Sun, 12 Feb 2017 20:36:18 +0800 Parents: 98fceaf61eff17d98926f3e6f8f39301066ca001 26fdebc63b642417820017e550d46c1b1f773504 Branches: PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=b56114e8fb90098e4f56e8bea92c8d5450a76483 Log: Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: Fixed bug #74084 (Out of bound read - zend_mm_alloc_small) Conflicts: Zend/zend_operators.c Bugs: https://bugs.php.net/74084 Changed paths: MM Zend/zend_operators.c Diff: diff --cc Zend/zend_operators.c index f2213c1,3a8929b..418d2f0 --- a/Zend/zend_operators.c +++ b/Zend/zend_operators.c @@@ -951,8 -926,13 +951,13 @@@ ZEND_API int ZEND_FASTCALL add_function } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_ADD, add_function); - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { - zendi_convert_scalar_to_number(op1, op1_copy, result); - zendi_convert_scalar_to_number(op2, op2_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); ++ zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { - zendi_convert_scalar_to_number(op1, op1_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { zend_throw_error(NULL, "Unsupported operand types"); @@@ -993,8 -984,13 +998,13 @@@ ZEND_API int ZEND_FASTCALL sub_function } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_SUB, sub_function); - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { - zendi_convert_scalar_to_number(op1, op1_copy, result); - zendi_convert_scalar_to_number(op2, op2_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); ++ zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { - zendi_convert_scalar_to_number(op1, op1_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { zend_throw_error(NULL, "Unsupported operand types"); @@@ -1040,8 -1036,13 +1050,13 @@@ ZEND_API int ZEND_FASTCALL mul_function } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_MUL, mul_function); - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { - zendi_convert_scalar_to_number(op1, op1_copy, result); - zendi_convert_scalar_to_number(op2, op2_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); ++ zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { - zendi_convert_scalar_to_number(op1, op1_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { zend_throw_error(NULL, "Unsupported operand types"); @@@ -1118,17 -1119,27 +1133,27 @@@ ZEND_API int ZEND_FASTCALL pow_function } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_POW, pow_function); - if (Z_TYPE_P(op1) == IS_ARRAY) { - ZVAL_LONG(result, 0); - return SUCCESS; - } else { - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - } - if (Z_TYPE_P(op2) == IS_ARRAY) { - ZVAL_LONG(result, 1L); - return SUCCESS; + if (EXPECTED(op1 != op2)) { + if (Z_TYPE_P(op1) == IS_ARRAY) { + ZVAL_LONG(result, 0); + return SUCCESS; + } else { - zendi_convert_scalar_to_number(op1, op1_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + } + if (Z_TYPE_P(op2) == IS_ARRAY) { + ZVAL_LONG(result, 1L); + return SUCCESS; + } else { - zendi_convert_scalar_to_number(op2, op2_copy, result); ++ zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } } else { - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (Z_TYPE_P(op1) == IS_ARRAY) { + ZVAL_LONG(result, 0); + return SUCCESS; + } else { - zendi_convert_scalar_to_number(op1, op1_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + } + op2 = op1; } converted = 1; } else { @@@ -1192,9 -1203,13 +1217,14 @@@ ZEND_API int ZEND_FASTCALL div_function op2 = Z_REFVAL_P(op2); } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_DIV, div_function); + - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { - zendi_convert_scalar_to_number(op1, op1_copy, result); - zendi_convert_scalar_to_number(op2, op2_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); ++ zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { - zendi_convert_scalar_to_number(op1, op1_copy, result); ++ zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { zend_throw_error(NULL, "Unsupported operand types");