diff --git a/Zend/tests/bug33116.phpt b/Zend/tests/bug33116.phpt new file mode 100755 index 00000000000..aa714a1f85a --- /dev/null +++ b/Zend/tests/bug33116.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #33116 (crash when assigning class name to global variable in __autoload) +--FILE-- + +--EXPECT-- +DefClass Object +( +) +Array +( + [0] => DefClass +) diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 9852180151d..0bfb3ff18a9 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -895,7 +895,7 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry *** { zval **args[1]; zval autoload_function; - zval class_name, *class_name_ptr = &class_name; + zval *class_name_ptr; zval *retval_ptr; int retval; char *lc_name; @@ -936,8 +936,9 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry *** ZVAL_STRINGL(&autoload_function, ZEND_AUTOLOAD_FUNC_NAME, sizeof(ZEND_AUTOLOAD_FUNC_NAME)-1, 0); + ALLOC_ZVAL(class_name_ptr); INIT_PZVAL(class_name_ptr); - ZVAL_STRINGL(class_name_ptr, name, name_length, 0); + ZVAL_STRINGL(class_name_ptr, name, name_length, 1); args[0] = &class_name_ptr; @@ -961,6 +962,8 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry *** retval = zend_call_function(&fcall_info, &fcall_cache TSRMLS_CC); EG(autoload_func) = fcall_cache.function_handler; + zval_ptr_dtor(&class_name_ptr); + zend_hash_del(EG(in_autoload), lc_name, name_length+1); if (retval == FAILURE) {