diff options
| author | Dmitry Stogov <dmitry@php.net> | 2011-12-28 09:59:39 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2011-12-28 09:59:39 +0000 |
| commit | c058385112e8aac09f6cbbcb54fed0773f83ce82 (patch) | |
| tree | 95872e8848554c6dd4ef939ea358e7fbc570cc4f | |
| parent | 503540a4e444fe1f8bd1f5ef652d456589bda5b0 (diff) | |
| download | php-git-c058385112e8aac09f6cbbcb54fed0773f83ce82.tar.gz | |
Fixed bug #60613 (Segmentation fault with $cls->{expr}() syntax)
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | Zend/tests/bug60613.phpt | 19 | ||||
| -rw-r--r-- | Zend/zend_compile.c | 3 |
3 files changed, 22 insertions, 1 deletions
@@ -2,6 +2,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Jan 2012, PHP 5.4.0 RC5 - Core: + . Fixed bug #60613 (Segmentation fault with $cls->{expr}() syntax). (Dmitry) . Fixed bug #60611 (Segmentation fault with Cls::{expr}() syntax). (Laruence) - CLI SAPI: diff --git a/Zend/tests/bug60613.phpt b/Zend/tests/bug60613.phpt new file mode 100644 index 0000000000..91b5369d3f --- /dev/null +++ b/Zend/tests/bug60613.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #60613 (Segmentation fault with $cls->{expr}() syntax) +--FILE-- +<?php +class Cls { + function __call($name, $arg) { + } +} + +$cls = new Cls(); +$cls->{0}(); +$cls->{1.0}(); +$cls->{true}(); +$cls->{false}(); +$cls->{null}(); +echo "ok\n"; +--EXPECT-- +ok + diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index c4e9291065..85d17f0d91 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -89,7 +89,8 @@ } while (0) #define FREE_POLYMORPHIC_CACHE_SLOT(literal) do { \ - if (CG(active_op_array)->literals[literal].cache_slot == \ + if (CG(active_op_array)->literals[literal].cache_slot != -1 && \ + CG(active_op_array)->literals[literal].cache_slot == \ CG(active_op_array)->last_cache_slot - POLYMORPHIC_CACHE_SLOT_SIZE) { \ CG(active_op_array)->literals[literal].cache_slot = -1; \ CG(active_op_array)->last_cache_slot -= POLYMORPHIC_CACHE_SLOT_SIZE; \ |