From f57cb13c566613eec0e1c2f6d96d18565436a9b7 Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Wed, 15 Jul 2015 22:46:53 +0200 Subject: [PATCH 1/2] Backport fix for bug #70083 to PHP-5.6 --- Zend/zend_vm_def.h | 7 ++++--- Zend/zend_vm_execute.h | 28 ++++++++++++++++------------ 2 files changed, 20 insertions(+), 15 deletions(-) diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 11f62053b18..7bfa814275d 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -1774,6 +1774,10 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV) SAVE_OPLINE(); value_ptr_ptr = GET_OP2_ZVAL_PTR_PTR(BP_VAR_W); + if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { + zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); + } + if (OP2_TYPE == IS_VAR && value_ptr_ptr && !Z_ISREF_PP(value_ptr_ptr) && @@ -1791,9 +1795,6 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV) } else if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { PZVAL_LOCK(*value_ptr_ptr); } - if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { - zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); - } variable_ptr_ptr = GET_OP1_ZVAL_PTR_PTR(BP_VAR_W); if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 5ed4135c596..07b9abc152d 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -20331,6 +20331,10 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL SAVE_OPLINE(); value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC); + if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { + zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); + } + if (IS_VAR == IS_VAR && value_ptr_ptr && !Z_ISREF_PP(value_ptr_ptr) && @@ -20348,9 +20352,6 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { PZVAL_LOCK(*value_ptr_ptr); } - if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { - zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); - } variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC); if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || @@ -23801,6 +23802,10 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE SAVE_OPLINE(); value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC); + if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { + zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); + } + if (IS_CV == IS_VAR && value_ptr_ptr && !Z_ISREF_PP(value_ptr_ptr) && @@ -23818,9 +23823,6 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { PZVAL_LOCK(*value_ptr_ptr); } - if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { - zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); - } variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC); if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || @@ -37492,6 +37494,10 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE SAVE_OPLINE(); value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC); + if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { + zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); + } + if (IS_VAR == IS_VAR && value_ptr_ptr && !Z_ISREF_PP(value_ptr_ptr) && @@ -37509,9 +37515,6 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { PZVAL_LOCK(*value_ptr_ptr); } - if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { - zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); - } variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC); if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || @@ -40675,6 +40678,10 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER SAVE_OPLINE(); value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC); + if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { + zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); + } + if (IS_CV == IS_VAR && value_ptr_ptr && !Z_ISREF_PP(value_ptr_ptr) && @@ -40692,9 +40699,6 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) { PZVAL_LOCK(*value_ptr_ptr); } - if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) { - zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object"); - } variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC); if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) || From 37e03f6b32832ebf51429d1a9ad71a7cb9068a66 Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Thu, 16 Jul 2015 09:29:43 +0200 Subject: [PATCH 2/2] Fix test; this should properly emit a fatal error, just as every other by-ref assignment to an overloaded object --- Zend/tests/bug69732.phpt | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/Zend/tests/bug69732.phpt b/Zend/tests/bug69732.phpt index 2ea5e58bc97..94b8d794f2f 100644 --- a/Zend/tests/bug69732.phpt +++ b/Zend/tests/bug69732.phpt @@ -24,7 +24,4 @@ Notice: Undefined property: wpq::$interesting in %sbug69732.php on line 6 Notice: Indirect modification of overloaded property wpq::$interesting has no effect in %sbug69732.php on line 16 -Strict Standards: Only variables should be assigned by reference in %sbug69732.php on line 16 - -Notice: Undefined property: wpq::$interesting in %sbug69732.php on line 6 -XXX +Fatal error: Cannot assign by reference to overloaded object in %sbug69732.php on line 16