clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-23 02:47:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #36303 (foreach on error_zval produces segfault)

Browse Source
This commit is contained in:
Dmitry Stogov 2006-02-06 11:46:12 +00:00
parent 96543b01ad
commit 47c90c571f
3 changed files with 27 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Zend/tests/bug36303.phpt Executable file
View File

@ -0,0 +1,12 @@
--TEST--
Bug #36303 (foreach on error_zval produces segfault)
--FILE--
<?php
$x="test";
foreach($x->a->b as &$v) {
}
echo "ok\n";
?>
--EXPECTF--
Warning: Invalid argument supplied for foreach() in %sbug36303.php on line 3
ok

4
Zend/zend_vm_def.h
View File

@ -3058,7 +3058,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
}
array_ptr = *array_ptr_ptr;
} else {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
}
array_ptr = *array_ptr_ptr;
array_ptr->refcount++;
}

16
Zend/zend_vm_execute.h
View File

@ -1997,7 +1997,9 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
}
array_ptr = *array_ptr_ptr;
} else {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
}
array_ptr = *array_ptr_ptr;
array_ptr->refcount++;
}
@ -4495,7 +4497,9 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
}
array_ptr = *array_ptr_ptr;
} else {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
}
array_ptr = *array_ptr_ptr;
array_ptr->refcount++;
}
@ -7590,7 +7594,9 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
}
array_ptr = *array_ptr_ptr;
} else {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
}
array_ptr = *array_ptr_ptr;
array_ptr->refcount++;
}
@ -20230,7 +20236,9 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
}
array_ptr = *array_ptr_ptr;
} else {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
}
array_ptr = *array_ptr_ptr;
array_ptr->refcount++;
}