cvs: ZendEngine2 / zend_object_handlers.c /tests bug39297.phpt

dmitry Wed Nov 8 13:38:44 2006 UTC Modified files: /ZendEngine2 zend_object_handlers.c /ZendEngine2/tests bug39297.phpt Log: Fixed bug #39297 (Memory corryption because of indirect modification of overloaded array). http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_object_handlers.c?r1=1.177&r2=1.178&diff_format=u Index: ZendEngine2/zend_object_handlers.c diff -u ZendEngine2/zend_object_handlers.c:1.177 ZendEngine2/zend_object_handlers.c:1.178 --- ZendEngine2/zend_object_handlers.c:1.177 Fri Oct 13 14:52:19 2006 +++ ZendEngine2/zend_object_handlers.c Wed Nov 8 13:38:44 2006 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_object_handlers.c,v 1.177 2006/10/13 14:52:19 andrei Exp $ */ +/* $Id: zend_object_handlers.c,v 1.178 2006/11/08 13:38:44 dmitry Exp $ */ #include "zend.h" #include "zend_globals.h" @@ -477,6 +477,19 @@ /* Undo PZVAL_LOCK() */ retval->refcount--; + if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && retval->refcount > 0) { + zval *tmp = retval; + + ALLOC_ZVAL(retval); + *retval = *tmp; + zval_copy_ctor(retval); + retval->is_ref = 0; + retval->refcount = 0; + if (Z_TYPE_P(retval) != IS_OBJECT) { + zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ce->name); + } + } + return retval; } else { zend_error(E_ERROR, "Cannot use object of type %v as array", ce->name); http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug39297.phpt?r1=1.1&r2=1.2&diff_format=u Index: ZendEngine2/tests/bug39297.phpt diff -u /dev/null ZendEngine2/tests/bug39297.phpt:1.2 --- /dev/null Wed Nov 8 13:38:44 2006 +++ ZendEngine2/tests/bug39297.phpt Wed Nov 8 13:38:44 2006 @@ -0,0 +1,45 @@ +--TEST-- +Bug #39297 (Memory corryption because of indirect modification of overloaded array) +--FILE-- +<?php +function compareByRef(&$first, &$second) { + return $first === $second; +} + +class MyTree implements ArrayAccess { + public $parent; + public $children = array(); + + public function offsetExists($offset) { + } + + public function offsetUnset($offset) { + } + + public function offsetSet($offset, $value) { + echo "offsetSet()\n"; + $cannonicalName = strtolower($offset); + $this->children[$cannonicalName] = $value; + $value->parent = $this; + } + + public function offsetGet($offset) { + echo "offsetGet()\n"; + $cannonicalName = strtolower($offset); + return $this->children[$cannonicalName]; + } + +} + +$id = 'Test'; + +$root = new MyTree(); +$child = new MyTree(); +$root[$id] = $child; + +var_dump(compareByRef($root[$id], $child)); +?> +--EXPECT-- +offsetSet() +offsetGet() +bool(true)