Merge branch 'PHP-5.5'

2 files changed, 37 insertions, 2 deletions

diff --git a/Zend/tests/bug65291.phpt b/Zend/tests/bug65291.phpt
new file mode 100644
index 0000000000..7bc76331c0
--- /dev/null
+++ b/Zend/tests/bug65291.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #65291 - get_defined_constants() causes PHP to crash in a very limited case.
+--FILE--
+<?php
+
+trait TestTrait
+{
+	public static function testStaticFunction()
+	{
+		return __CLASS__;
+	}
+}
+class Tester
+{
+	use TestTrait;
+}
+
+$foo = Tester::testStaticFunction();
+get_defined_constants();
+get_defined_constants(true);
+
+echo $foo;
+?>
+--EXPECT--
+Tester
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 47fb4d2d9b..383f5333e5 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1911,6 +1911,11 @@ static int add_constant_info(zend_constant *constant, void *arg TSRMLS_DC)
 	zval *name_array = (zval *)arg;
 	zval *const_val;
 
+	if (!constant->name) {
+		/* skip special constants */
+		return 0;
+	}
+
 	MAKE_STD_ZVAL(const_val);
 	*const_val = constant->value;
 	zval_copy_ctor(const_val);
@@ -1978,11 +1983,16 @@ ZEND_FUNCTION(get_defined_constants)
 		while (zend_hash_get_current_data_ex(EG(zend_constants), (void **) &val, &pos) != FAILURE) {
 			zval *const_val;
 
+			if (!val->name) {
+				/* skip special constants */
+				goto next_constant;
+			}
+
 			if (val->module_number == PHP_USER_CONSTANT) {
 				module_number = i;
 			} else if (val->module_number > i || val->module_number < 0) {
 				/* should not happen */
-				goto bad_module_id;
+				goto next_constant;
 			} else {
 				module_number = val->module_number;
 			}
@@ -1999,7 +2009,7 @@ ZEND_FUNCTION(get_defined_constants)
 			INIT_PZVAL(const_val);
 
 			add_assoc_zval_ex(modules[module_number], val->name, val->name_len, const_val);
-bad_module_id:
+next_constant:
 			zend_hash_move_forward_ex(EG(zend_constants), &pos);
 		}
 		efree(module_names);