cvs: ZendEngine2(PHP_5_2) / zend_execute.c

dmitry Tue Mar 4 11:48:53 2008 UTC Modified files: (Branch: PHP_5_2) /ZendEngine2 zend_execute.c Log: Fixed wrong result of cascading assignment to string offset Fixed memory corruption on cascading assignment of IS_TMP_VAR into string offset Fixed opcode caches shared memory corruption on cascading assignment of IS_CONST into string offset http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_execute.c?r1=1.716.2.12.2.27&r2=1.716.2.12.2.28&diff_format=u Index: ZendEngine2/zend_execute.c diff -u ZendEngine2/zend_execute.c:1.716.2.12.2.27 ZendEngine2/zend_execute.c:1.716.2.12.2.28 --- ZendEngine2/zend_execute.c:1.716.2.12.2.27 Mon Feb 18 12:11:34 2008 +++ ZendEngine2/zend_execute.c Tue Mar 4 11:48:53 2008 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_execute.c,v 1.716.2.12.2.27 2008/02/18 12:11:34 dmitry Exp $ */ +/* $Id: zend_execute.c,v 1.716.2.12.2.28 2008/03/04 11:48:53 dmitry Exp $ */ #define ZEND_INTENSIVE_DEBUGGING 0 @@ -645,7 +645,13 @@ if (((int)T->str_offset.offset < 0)) { zend_error(E_WARNING, "Illegal string offset: %d", T->str_offset.offset); - break; + if (!RETURN_VALUE_UNUSED(result)) { + T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr); + PZVAL_LOCK(*T(result->u.var).var.ptr_ptr); + AI_USE_PTR(T(result->u.var).var); + } + FREE_OP_VAR_PTR(free_op1); + return; } if (T->str_offset.offset >= Z_STRLEN_P(T->str_offset.str)) { zend_uint i; @@ -665,7 +671,7 @@ if (Z_TYPE_P(value)!=IS_STRING) { tmp = *value; - if (op2->op_type & (IS_VAR|IS_CV)) { + if (op2->op_type != IS_TMP_VAR) { zval_copy_ctor(&tmp); } convert_to_string(&tmp); @@ -674,16 +680,13 @@ Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset] = Z_STRVAL_P(final_value)[0]; - if (op2->op_type == IS_TMP_VAR) { - if (final_value == &T(op2->u.var).tmp_var) { - /* we can safely free final_value here - * because separation is done only - * in case op2->op_type == IS_VAR */ - STR_FREE(Z_STRVAL_P(final_value)); - } - } if (final_value == &tmp) { zval_dtor(final_value); + } else if (op2->op_type == IS_TMP_VAR) { + /* we can safely free final_value here + * because separation is done only + * in case op2->op_type == IS_VAR */ + STR_FREE(Z_STRVAL_P(final_value)); } /* * the value of an assignment to a string offset is undefined @@ -692,11 +695,11 @@ } while (0); /* zval_ptr_dtor(&T->str_offset.str); Nuke this line if it doesn't cause a leak */ -/* T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr); */ if (!RETURN_VALUE_UNUSED(result)) { - T(result->u.var).var.ptr_ptr = &value; - PZVAL_LOCK(*T(result->u.var).var.ptr_ptr); - AI_USE_PTR(T(result->u.var).var); + T(result->u.var).var.ptr_ptr = &T(result->u.var).var.ptr; + ALLOC_ZVAL(T(result->u.var).var.ptr); + INIT_PZVAL(T(result->u.var).var.ptr); + ZVAL_STRINGL(T(result->u.var).var.ptr, Z_STRVAL_P(T->str_offset.str)+T->str_offset.offset, 1, 1); } FREE_OP_VAR_PTR(free_op1); return;