diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2013-05-21 09:58:11 +0400 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@zend.com> | 2013-05-21 09:58:11 +0400 |
| commit | 77fffff15762137e2d8173df9b733b4cb70fc996 (patch) | |
| tree | 6f6f604eb848d770c1147470cdc811dc058da0ba | |
| parent | 1124b0678f9e60384736c7c1a0d1e84c633a5e7a (diff) | |
| download | php-git-77fffff15762137e2d8173df9b733b4cb70fc996.tar.gz | |
Fixed bug #64720 (SegFault on zend_deactivate)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | Zend/tests/bug64720.phpt | 48 | ||||
| -rw-r--r-- | Zend/zend_object_handlers.c | 8 | ||||
| -rw-r--r-- | Zend/zend_opcode.c | 3 |
4 files changed, 59 insertions, 1 deletions
@@ -3,6 +3,7 @@ PHP NEWS ?? ??? 2013, PHP 5.4.16 - Core: + . Fixed bug #64720 (SegFault on zend_deactivate). (Dmitry) . Fixed bug #64729 (compilation failure on x32). (Gustavo) . Fixed bug #64660 (Segfault on memory exhaustion within function definition). (Stas, reported by Juha Kylmänen) diff --git a/Zend/tests/bug64720.phpt b/Zend/tests/bug64720.phpt new file mode 100644 index 0000000000..6c33165bb5 --- /dev/null +++ b/Zend/tests/bug64720.phpt @@ -0,0 +1,48 @@ +--TEST-- +Bug #64720 (SegFault on zend_deactivate) +--FILE-- +<?php +class Stat { + private static $requests; + public static function getInstance() { + if (!isset(self::$requests[1])) { + self::$requests[1] = new self(); + } + return self::$requests[1]; + } + + public function __destruct() { + unset(self::$requests[1]); + } +} + +class Foo { + public function __construct() { + Stat::getInstance(); + } +} + +class Error { + private $trace; + public function __construct() { + $this->trace = debug_backtrace(1); + } +} + +class Bar { + public function __destruct() { + Stat::getInstance(); + new Error(); + } + + public function test() { + new Error(); + } +} + +$foo = new Foo(); +$bar = new Bar(); +$bar->test(); +?> +--EXPECTF-- +Fatal error: Access to undeclared static property: Stat::$requests in %sbug64720.php on line 12 diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index cc45d35ecd..c2bb056a9a 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -1278,6 +1278,14 @@ ZEND_API zval **zend_std_get_static_property(zend_class_entry *ce, const char *p } } + if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL) || + UNEXPECTED(CE_STATIC_MEMBERS(ce)[property_info->offset] == NULL)) { + if (!silent) { + zend_error_noreturn(E_ERROR, "Access to undeclared static property: %s::$%s", ce->name, property_name); + } + return NULL; + } + return &CE_STATIC_MEMBERS(ce)[property_info->offset]; } /* }}} */ diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c index e673f0197c..695b651a87 100644 --- a/Zend/zend_opcode.c +++ b/Zend/zend_opcode.c @@ -162,8 +162,9 @@ static inline void cleanup_user_class_data(zend_class_entry *ce TSRMLS_DC) for (i = 0; i < ce->default_static_members_count; i++) { if (ce->static_members_table[i]) { - zval_ptr_dtor(&ce->static_members_table[i]); + zval *p = ce->static_members_table[i]; ce->static_members_table[i] = NULL; + zval_ptr_dtor(&p); } } ce->static_members_table = NULL; |