summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--NEWS2
-rw-r--r--Zend/zend_vm_def.h1
-rw-r--r--Zend/zend_vm_execute.h1
3 files changed, 4 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index f7dedb1c9f..6988c653ba 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP NEWS
(Andrey)
- Fixed bug #34064 (arr[] as param to function in class gives invalid opcode).
(Dmitry)
+- Fixed bug #34062 (Crash in catch block when many arguments are used).
+ (Dmitry)
- Fixed bug #34045 (Buffer overflow with serialized object). (Dmitry)
- Fixed bug #33999 (object remains object when cast to int). (Dmitry)
- Fixed bug #33996 (No information given for fatal error on passing invalid
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 805c31cb0b..b96d1a1e7f 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3579,6 +3579,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
while (*stack_zval_pp != NULL) {
zval_ptr_dtor(stack_zval_pp);
EG(argument_stack).top_element--;
+ EG(argument_stack).top--;
stack_zval_pp--;
}
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 81a60695f8..c60cef5c88 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -520,6 +520,7 @@ static int ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
while (*stack_zval_pp != NULL) {
zval_ptr_dtor(stack_zval_pp);
EG(argument_stack).top_element--;
+ EG(argument_stack).top--;
stack_zval_pp--;
}