diff options
| author | Xinchen Hui <laruence@php.net> | 2013-04-04 14:48:53 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2013-04-04 14:48:53 +0800 |
| commit | 65e368debdbc0f321af95e402b0d151288018ba2 (patch) | |
| tree | 1209537f226e1f156edd16a240f7028c9cbc24af | |
| parent | 1f34ccbe34783f5671bc2a68e7299cea7493c82b (diff) | |
| parent | 82ac3106e061b31ccbbf53a5276eae441254057d (diff) | |
| download | php-git-65e368debdbc0f321af95e402b0d151288018ba2.tar.gz | |
Merge branch 'PHP-5.4' into PHP-5.5
| -rw-r--r-- | Zend/tests/bug64578.phpt | 13 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 7 |
2 files changed, 17 insertions, 3 deletions
diff --git a/Zend/tests/bug64578.phpt b/Zend/tests/bug64578.phpt new file mode 100644 index 0000000000..73b3ec4f97 --- /dev/null +++ b/Zend/tests/bug64578.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #64578 (debug_backtrace in set_error_handler corrupts zend heap: segfault) +--FILE-- +<?php + +set_error_handler(function() { debug_backtrace(); }); + +function x($s) { $s['a'] = 1; }; +$y = '1'; +x($y); +print_r($y); +--EXPECTF-- +1 diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index b2d06238fa..a65f5331de 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1144,6 +1144,10 @@ convert_to_array: zend_error_noreturn(E_ERROR, "[] operator not supported for strings"); } + if (type != BP_VAR_UNSET) { + SEPARATE_ZVAL_IF_NOT_REF(container_ptr); + } + if (Z_TYPE_P(dim) != IS_LONG) { switch(Z_TYPE_P(dim)) { @@ -1172,9 +1176,6 @@ convert_to_array: convert_to_long(&tmp); dim = &tmp; } - if (type != BP_VAR_UNSET) { - SEPARATE_ZVAL_IF_NOT_REF(container_ptr); - } container = *container_ptr; result->str_offset.str = container; PZVAL_LOCK(container); |