Merge branch 'PHP-7.3' into PHP-7.4

6 files changed, 92 insertions, 18 deletions

diff --git a/Zend/tests/bug77660.phpt b/Zend/tests/bug77660.phpt
new file mode 100644
index 0000000000..94af1f9e2c
--- /dev/null
+++ b/Zend/tests/bug77660.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #77660 (Segmentation fault on break 2147483648)
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+--FILE--
+<?php
+for(;;) break 2147483648;
+?>
+--EXPECTF--
+Fatal error: Cannot 'break' 2147483648 levels in %sbug77660.php on line %d
diff --git a/Zend/tests/exception_getters_with_ref_props.phpt b/Zend/tests/exception_getters_with_ref_props.phpt
new file mode 100644
index 0000000000..d3dcd8326f
--- /dev/null
+++ b/Zend/tests/exception_getters_with_ref_props.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Calling exception getters when properties hold references
+--FILE--
+<?php
+
+class MyException extends Exception {
+    public function __construct(&$refMsg, &$refCode, &$refFile, &$refLine) {
+        $this->message =& $refMsg;
+        $this->code =& $refCode;
+        $this->file =& $refFile;
+        $this->line =& $refLine;
+    }
+}
+
+$refMsg = "foo";
+$refCode = 0;
+$refFile = "foobar";
+$refLine = 42;
+$ex = new MyException($refMsg, $refCode, $refFile, $refLine);
+var_dump($ex->getMessage());
+var_dump($ex->getCode());
+var_dump($ex->getFile());
+var_dump($ex->getLine());
+
+?>
+--EXPECT--
+string(3) "foo"
+int(0)
+string(6) "foobar"
+int(42)
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 7c5c027a54..75ced7c57c 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -4303,7 +4303,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 	zend_ast *depth_ast = ast->child[0];
 
 	zend_op *opline;
-	int depth;
+	zend_long depth;
 
 	ZEND_ASSERT(ast->kind == ZEND_AST_BREAK || ast->kind == ZEND_AST_CONTINUE);
 
@@ -4330,7 +4330,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 			ast->kind == ZEND_AST_BREAK ? "break" : "continue");
 	} else {
 		if (!zend_handle_loops_and_finally_ex(depth, NULL)) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' %d level%s",
+			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' " ZEND_LONG_FMT " level%s",
 				ast->kind == ZEND_AST_BREAK ? "break" : "continue",
 				depth, depth == 1 ? "" : "s");
 		}
@@ -4347,12 +4347,12 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 			if (depth == 1) {
 				zend_error(E_WARNING,
 					"\"continue\" targeting switch is equivalent to \"break\". " \
-					"Did you mean to use \"continue %d\"?",
+					"Did you mean to use \"continue " ZEND_LONG_FMT "\"?",
 					depth + 1);
 			} else {
 				zend_error(E_WARNING,
-					"\"continue %d\" targeting switch is equivalent to \"break %d\". " \
-					"Did you mean to use \"continue %d\"?",
+					"\"continue " ZEND_LONG_FMT "\" targeting switch is equivalent to \"break " ZEND_LONG_FMT "\". " \
+					"Did you mean to use \"continue " ZEND_LONG_FMT "\"?",
 					depth, depth, depth + 1);
 			}
 		}
diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c
index 8352348a53..e53ea1f1c7 100644
--- a/Zend/zend_exceptions.c
+++ b/Zend/zend_exceptions.c
@@ -400,11 +400,13 @@ ZEND_METHOD(error_exception, __construct)
    Get the file in which the exception occurred */
 ZEND_METHOD(exception, getFile)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(ZEND_THIS, ZEND_STR_FILE));
+	prop = GET_PROPERTY(ZEND_THIS, ZEND_STR_FILE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -412,11 +414,13 @@ ZEND_METHOD(exception, getFile)
    Get the line in which the exception occurred */
 ZEND_METHOD(exception, getLine)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(ZEND_THIS, ZEND_STR_LINE));
+	prop = GET_PROPERTY(ZEND_THIS, ZEND_STR_LINE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -424,11 +428,13 @@ ZEND_METHOD(exception, getLine)
    Get the exception message */
 ZEND_METHOD(exception, getMessage)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(ZEND_THIS, ZEND_STR_MESSAGE));
+	prop = GET_PROPERTY(ZEND_THIS, ZEND_STR_MESSAGE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -436,11 +442,13 @@ ZEND_METHOD(exception, getMessage)
    Get the exception code */
 ZEND_METHOD(exception, getCode)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(ZEND_THIS, ZEND_STR_CODE));
+	prop = GET_PROPERTY(ZEND_THIS, ZEND_STR_CODE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -448,11 +456,13 @@ ZEND_METHOD(exception, getCode)
    Get the stack trace for the location in which the exception occurred */
 ZEND_METHOD(exception, getTrace)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(ZEND_THIS, ZEND_STR_TRACE));
+	prop = GET_PROPERTY(ZEND_THIS, ZEND_STR_TRACE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -460,11 +470,13 @@ ZEND_METHOD(exception, getTrace)
    Get the exception severity */
 ZEND_METHOD(error_exception, getSeverity)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(ZEND_THIS, ZEND_STR_SEVERITY));
+	prop = GET_PROPERTY(ZEND_THIS, ZEND_STR_SEVERITY);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
diff --git a/ext/standard/tests/streams/bug77664.phpt b/ext/standard/tests/streams/bug77664.phpt
new file mode 100644
index 0000000000..6a925417e2
--- /dev/null
+++ b/ext/standard/tests/streams/bug77664.phpt
@@ -0,0 +1,19 @@
+--TEST--
+BUG #77664 (Segmentation fault when using undefined constant in custom wrapper)
+--FILE--
+<?php
+class ErrorWrapper {
+	public $context;
+	public $var = self::INVALID;
+}
+stream_wrapper_register('error',ErrorWrapper::class);
+file_get_contents('error://test');
+?>
+--EXPECTF--
+Warning: file_get_contents(error://test): failed to open stream: operation failed in %sbug77664.php on line %d
+
+Fatal error: Uncaught Error: Undefined class constant 'self::INVALID' in %sbug77664.php:%d
+Stack trace:
+#0 %sbug77664.php(%d): file_get_contents('error://test')
+#1 {main}
+  thrown in %sbug77664.php on line %d
diff --git a/main/streams/userspace.c b/main/streams/userspace.c
index dc0d81a59a..73b71863a4 100644
--- a/main/streams/userspace.c
+++ b/main/streams/userspace.c
@@ -287,7 +287,10 @@ static void user_stream_create_object(struct php_user_stream_wrapper *uwrap, php
 	}
 
 	/* create an instance of our class */
-	object_init_ex(object, uwrap->ce);
+	if (object_init_ex(object, uwrap->ce) == FAILURE) {
+		ZVAL_UNDEF(object);
+		return;
+	}
 
 	if (context) {
 		add_property_resource(object, "context", context->res);