diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2016-07-07 00:59:44 +0300 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@zend.com> | 2016-07-07 00:59:44 +0300 |
| commit | fbca255cd001e377202437d8fabded0192107d84 (patch) | |
| tree | 72254165ef0c24bfbc4570036f04990a870d9960 /Zend/zend_compile.c | |
| parent | ab304579ff046426f281e9a95abea8d611e38e1c (diff) | |
| download | php-git-fbca255cd001e377202437d8fabded0192107d84.tar.gz | |
Fixed bug #71539 (Memory error on $arr[$a] =& $arr[$b] if RHS rehashes)
Diffstat (limited to 'Zend/zend_compile.c')
| -rw-r--r-- | Zend/zend_compile.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index bf1615e8bb..af5f5034be 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -3029,7 +3029,20 @@ void zend_compile_assign_ref(znode *result, zend_ast *ast) /* {{{ */ offset = zend_delayed_compile_begin(); zend_delayed_compile_var(&target_node, target_ast, BP_VAR_W); - zend_delayed_compile_var(&source_node, source_ast, BP_VAR_W); + zend_compile_var(&source_node, source_ast, BP_VAR_W); + + if ((target_ast->kind != ZEND_AST_VAR + || target_ast->child[0]->kind != ZEND_AST_ZVAL) + && source_node.op_type != IS_CV) { + /* Both LHS and RHS expressions may modify the same data structure, + * and the modification during RHS evaluation may dangle the pointer + * to the result of the LHS evaluation. + * Use MAKE_REF instruction to replace direct pointer with REFERENCE. + * See: Bug #71539 + */ + zend_emit_op(&source_node, ZEND_MAKE_REF, &source_node, NULL); + } + zend_delayed_compile_end(offset); if (source_node.op_type != IS_VAR && zend_is_call(source_ast)) { |