summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorXinchen Hui <laruence@gmail.com>2015-10-03 19:38:56 -0700
committerXinchen Hui <laruence@gmail.com>2015-10-03 19:38:56 -0700
commitc147d90dbfcc4f9fd494215b7e5740e497d818c1 (patch)
tree664790486537768600f1ccc7564d5bf8fd8bfdab
parent83bef0ef83f645a6b84ba77b7c69ecdbad68f0a1 (diff)
downloadphp-git-c147d90dbfcc4f9fd494215b7e5740e497d818c1.tar.gz
Fixed bug #70601 (Segfault in gc_remove_from_buffer())
-rw-r--r--NEWS3
-rw-r--r--ext/opcache/Optimizer/pass1_5.c4
-rw-r--r--ext/opcache/tests/bug70601.phpt23
3 files changed, 29 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index 7f5c7a40a6..4adadb2083 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,9 @@ PHP NEWS
(Andrey)
. Fixed bug #70572 segfault in mysqlnd_connect. (Andrey, Remi)
+- Opcache:
+ . Fixed bug #70601 (Segfault in gc_remove_from_buffer()). (Laruence)
+
01 Oct 2015, PHP 5.6.14
- Core:
diff --git a/ext/opcache/Optimizer/pass1_5.c b/ext/opcache/Optimizer/pass1_5.c
index 4ed3dd4c85..1302e4b182 100644
--- a/ext/opcache/Optimizer/pass1_5.c
+++ b/ext/opcache/Optimizer/pass1_5.c
@@ -314,9 +314,11 @@ if (ZEND_OPTIMIZER_PASS_1 & OPTIMIZATION_LEVEL) {
ZEND_IS_CONSTANT_TYPE(Z_TYPE(t))) {
break;
}
- } else {
+ } else if (Z_TYPE_PP(c) <= IS_BOOL || Z_TYPE_PP(c) == IS_STRING) {
t = **c;
zval_copy_ctor(&t);
+ } else {
+ break;
}
if (ZEND_OP1_TYPE(opline) == IS_CONST) {
diff --git a/ext/opcache/tests/bug70601.phpt b/ext/opcache/tests/bug70601.phpt
new file mode 100644
index 0000000000..55b1d7e4c2
--- /dev/null
+++ b/ext/opcache/tests/bug70601.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #70601 (Segfault in gc_remove_from_buffer())
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.protect_memory=1
+--SKIPIF--
+<?php if (!extension_loaded('Zend OPcache')) die("skip"); ?>
+--FILE--
+<?php
+const REPLACEMENTS_PASS_1 = [ "\x00" => "" ];
+class a {
+ const REPLACEMENTS_PASS_1 = [ "\x01" => "" ];
+ public function __construct() {
+ echo strtr("Ok", REPLACEMENTS_PASS_1);
+ echo strtr("ay", self::REPLACEMENTS_PASS_1);
+ }
+}
+
+new a();
+?>
+--EXPECT--
+Okay