diff options
| author | Dmitry Stogov <dmitry@php.net> | 2011-03-16 15:21:38 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2011-03-16 15:21:38 +0000 |
| commit | e90ac23f580e691d8305f7e4412968d5d5e22bfb (patch) | |
| tree | 3d2055467c5283da22b75b362bf4e940e8855d33 /Zend/zend_execute.c | |
| parent | b78ac8df822369c617568c98e15eff2a90627d16 (diff) | |
| download | php-git-e90ac23f580e691d8305f7e4412968d5d5e22bfb.tar.gz | |
Fixed bug #54265 (crash when variable gets reassigned in error handler)
Diffstat (limited to 'Zend/zend_execute.c')
| -rw-r--r-- | Zend/zend_execute.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index e270816d8b..f10fce38dc 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -536,10 +536,22 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, zval (Z_TYPE_P(object) == IS_BOOL && Z_LVAL_P(object) == 0) || (Z_TYPE_P(object) == IS_STRING && Z_STRLEN_P(object) == 0)) { SEPARATE_ZVAL_IF_NOT_REF(object_ptr); - zval_dtor(*object_ptr); - object_init(*object_ptr); object = *object_ptr; + Z_ADDREF_P(object); zend_error(E_STRICT, "Creating default object from empty value"); + if (Z_REFCOUNT_P(object) == 1) { + /* object was removed by error handler, nothing to assign to */ + zval_ptr_dtor(&object); + if (retval) { + *retval = &EG(uninitialized_zval); + PZVAL_LOCK(*retval); + } + FREE_OP(free_value); + return; + } + Z_DELREF_P(object); + zval_dtor(object); + object_init(object); } else { zend_error(E_WARNING, "Attempt to assign property of non-object"); if (!RETURN_VALUE_UNUSED(result)) { |