diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-08-21 17:39:52 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-08-21 17:39:52 +0800 |
| commit | e572035ecf3ba4eb520eff4afa19bc4e53ce9c9f (patch) | |
| tree | 0a2f2dc73c09072b3891f5a62cc6ea3ba39f2b3c | |
| parent | 8855a2ce76e8bfba1d2eea1345c765fde7a9a441 (diff) | |
| parent | 0476bb1de54896b6c062125f22318533998ce94a (diff) | |
| download | php-git-e572035ecf3ba4eb520eff4afa19bc4e53ce9c9f.tar.gz | |
Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
Fixed bug #72911 (Memleak in zend_binary_assign_op_obj_helper)
Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260))
| -rw-r--r-- | Zend/tests/bug72911.phpt | 17 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 4 |
2 files changed, 20 insertions, 1 deletions
diff --git a/Zend/tests/bug72911.phpt b/Zend/tests/bug72911.phpt new file mode 100644 index 0000000000..098261cadf --- /dev/null +++ b/Zend/tests/bug72911.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #72911 (Memleak in zend_binary_assign_op_obj_helper) +--FILE-- +<?php + +$a = 0; + +$b = $a->b->i -= 0; + +var_dump($b); + +?> +--EXPECTF-- +Warning: Attempt to modify property of non-object in %sbug72911.php on line %d + +Warning: Attempt to assign property of non-object in %sbug72911.php on line %d +NULL diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index d2411ad5c3..13494ca403 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -586,7 +586,9 @@ static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *v static inline int make_real_object(zval *object) { if (UNEXPECTED(Z_TYPE_P(object) != IS_OBJECT)) { - if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE)) { + if (UNEXPECTED(object == &EG(error_zval))) { + return 0; + } else if (EXPECTED(Z_TYPE_P(object) <= IS_FALSE)) { /* nothing to destroy */ } else if (EXPECTED((Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0))) { zval_ptr_dtor_nogc(object); |