clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-10-01 06:46:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of https://git.php.net/repository/php-src

Browse Source 
* 'master' of https://git.php.net/repository/php-src:
  Fix bug #65821: By-ref foreach on property access of string offset segfaults
  Fixed bug #64230 (XMLReader does not suppress errors)
This commit is contained in:
Christopher Jones 2013-10-04 05:41:03 -07:00
commit 27d46a4454
5 changed files with 52 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
Zend/zend_compile.c
View File

@ -1737,7 +1737,6 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
zend_op dummy_opline;
dummy_opline.result_type = IS_UNUSED;
dummy_opline.op1_type = IS_UNUSED;
zend_stack_push(&CG(foreach_copy_stack), (void *) &dummy_opline, sizeof(zend_op));
}
@ -2647,7 +2646,7 @@ static int generate_free_switch_expr(const zend_switch_entry *switch_entry TSRML
opline->opcode = (switch_entry->cond.op_type == IS_TMP_VAR) ? ZEND_FREE : ZEND_SWITCH_FREE;
SET_NODE(opline->op1, &switch_entry->cond);
SET_UNUSED(opline->op2);
opline->extended_value = 0;
return 0;
}
/* }}} */
@ -2657,7 +2656,7 @@ static int generate_free_foreach_copy(const zend_op *foreach_copy TSRMLS_DC) /*
zend_op *opline;
/* If we reach the separator then stop applying the stack */
if (foreach_copy->result_type == IS_UNUSED && foreach_copy->op1_type == IS_UNUSED) {
if (foreach_copy->result_type == IS_UNUSED) {
return 1;
}
@ -2666,16 +2665,6 @@ static int generate_free_foreach_copy(const zend_op *foreach_copy TSRMLS_DC) /*
opline->opcode = (foreach_copy->result_type == IS_TMP_VAR) ? ZEND_FREE : ZEND_SWITCH_FREE;
COPY_NODE(opline->op1, foreach_copy->result);
SET_UNUSED(opline->op2);
opline->extended_value = 1;
if (foreach_copy->op1_type != IS_UNUSED) {
opline = get_next_op(CG(active_op_array) TSRMLS_CC);
opline->opcode = (foreach_copy->op1_type == IS_TMP_VAR) ? ZEND_FREE : ZEND_SWITCH_FREE;
COPY_NODE(opline->op1, foreach_copy->op1);
SET_UNUSED(opline->op2);
opline->extended_value = 0;
}
return 0;
}
@ -6225,7 +6214,6 @@ void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, zno
{
zend_op *opline;
zend_bool is_variable;
zend_bool push_container = 0;
zend_op dummy_opline;
if (variable) {
@ -6237,14 +6225,6 @@ void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, zno
/* save the location of FETCH_W instruction(s) */
open_brackets_token->u.op.opline_num = get_next_op_number(CG(active_op_array));
zend_do_end_variable_parse(array, BP_VAR_W, 0 TSRMLS_CC);
if (CG(active_op_array)->last > 0 &&
CG(active_op_array)->opcodes[CG(active_op_array)->last-1].opcode == ZEND_FETCH_OBJ_W) {
/* Only lock the container if we are fetching from a real container and not $this */
if (CG(active_op_array)->opcodes[CG(active_op_array)->last-1].op1_type == IS_VAR) {
CG(active_op_array)->opcodes[CG(active_op_array)->last-1].extended_value |= ZEND_FETCH_ADD_LOCK;
push_container = 1;
}
}
} else {
is_variable = 0;
open_brackets_token->u.op.opline_num = get_next_op_number(CG(active_op_array));
@ -6264,11 +6244,6 @@ void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, zno
opline->extended_value = is_variable ? ZEND_FE_RESET_VARIABLE : 0;
COPY_NODE(dummy_opline.result, opline->result);
if (push_container) {
COPY_NODE(dummy_opline.op1, CG(active_op_array)->opcodes[CG(active_op_array)->last-2].op1);
} else {
dummy_opline.op1_type = IS_UNUSED;
}
zend_stack_push(&CG(foreach_copy_stack), (void *) &dummy_opline, sizeof(zend_op));
/* save the location of FE_FETCH */
@ -6325,7 +6300,6 @@ void zend_do_foreach_cont(znode *foreach_token, const znode *open_brackets_token
opline->extended_value |= ZEND_FE_FETCH_BYREF;
CG(active_op_array)->opcodes[foreach_token->u.op.opline_num].extended_value |= ZEND_FE_RESET_REFERENCE;
} else {
zend_op *foreach_copy;
zend_op *fetch = &CG(active_op_array)->opcodes[foreach_token->u.op.opline_num];
zend_op *end = &CG(active_op_array)->opcodes[open_brackets_token->u.op.opline_num];
@ -6342,9 +6316,6 @@ void zend_do_foreach_cont(znode *foreach_token, const znode *open_brackets_token
fetch->opcode -= 3; /* FETCH_W -> FETCH_R */
}
}
/* prevent double SWITCH_FREE */
zend_stack_top(&CG(foreach_copy_stack), (void **) &foreach_copy);
foreach_copy->op1_type = IS_UNUSED;
}
GET_NODE(&value_node, opline->result);

5
Zend/zend_vm_def.h
View File

@ -1388,11 +1388,6 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
SAVE_OPLINE();
property = GET_OP2_ZVAL_PTR(BP_VAR_R);
if (OP1_TYPE == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (IS_OP2_TMP_FREE()) {
MAKE_REAL_ZVAL_PTR(property);
}

60
Zend/zend_vm_execute.h
View File

@ -14996,11 +14996,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HA
SAVE_OPLINE();
property = opline->op2.zv;
if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -17335,11 +17330,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HAND
SAVE_OPLINE();
property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (1) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -19579,11 +19569,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HAND
SAVE_OPLINE();
property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -23023,11 +23008,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDL
SAVE_OPLINE();
property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
if (IS_VAR == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -24794,11 +24774,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE
SAVE_OPLINE();
property = opline->op2.zv;
if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -26206,11 +26181,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_H
SAVE_OPLINE();
property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (1) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -27521,11 +27491,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_H
SAVE_OPLINE();
property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -29260,11 +29225,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HA
SAVE_OPLINE();
property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
if (IS_UNUSED == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -32415,11 +32375,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HAN
SAVE_OPLINE();
property = opline->op2.zv;
if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -34520,11 +34475,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDL
SAVE_OPLINE();
property = _get_zval_ptr_tmp(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (1) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -36627,11 +36577,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDL
SAVE_OPLINE();
property = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}
@ -39786,11 +39731,6 @@ static int ZEND_FASTCALL ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLE
SAVE_OPLINE();
property = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var TSRMLS_CC);
if (IS_CV == IS_VAR && (opline->extended_value & ZEND_FETCH_ADD_LOCK)) {
PZVAL_LOCK(*EX_T(opline->op1.var).var.ptr_ptr);
EX_T(opline->op1.var).var.ptr = *EX_T(opline->op1.var).var.ptr_ptr;
}
if (0) {
MAKE_REAL_ZVAL_PTR(property);
}

2
ext/xmlreader/php_xmlreader.c
View File

@ -799,7 +799,6 @@ PHP_METHOD(xmlreader, read)
if (intern != NULL && intern->ptr != NULL) {
retval = xmlTextReaderRead(intern->ptr);
if (retval == -1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "An Error Occurred while reading");
RETURN_FALSE;
} else {
RETURN_BOOL(retval);
@ -841,7 +840,6 @@ PHP_METHOD(xmlreader, next)
retval = xmlTextReaderNext(intern->ptr);
}
if (retval == -1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "An Error Occurred while reading");
RETURN_FALSE;
} else {
RETURN_BOOL(retval);

50
ext/xmlreader/tests/bug64230.phpt Normal file
View File

@ -0,0 +1,50 @@
--TEST--
Bug #64230 (XMLReader does not suppress errors)
--SKIPIF--
<?php
extension_loaded("xmlreader") or die("skip requires xmlreader");
?>
--FILE--
<?php
echo "Test\n";
function show_internal_errors() {
foreach (libxml_get_errors() as $error) {
printf("Internal: %s\n", $error->message);
}
libxml_clear_errors();
}
echo "Internal errors TRUE\n";
libxml_use_internal_errors(true);
$x = new XMLReader;
$x->xml("<root att/>");
$x->read();
show_internal_errors();
echo "Internal errors FALSE\n";
libxml_use_internal_errors(false);
$x = new XMLReader;
$x->xml("<root att/>");
$x->read();
show_internal_errors();
?>
Done
--EXPECTF--
Test
Internal errors TRUE
Internal: Specification mandate value for attribute att
Internal errors FALSE
Warning: XMLReader::read(): %s: parser error : Specification mandate value for attribute att in %s on line %d
Warning: XMLReader::read(): <root att/> in %s on line %d
Warning: XMLReader::read(): ^ in %s on line %d
Done