diff options
| author | Dmitry Stogov <dmitry@php.net> | 2011-09-14 13:18:19 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2011-09-14 13:18:19 +0000 |
| commit | 750e4e10117d75e536bdcfdf344a18aaf8637739 (patch) | |
| tree | 50c383ebfe124a157ac14d348ca7143265a82dcd | |
| parent | 4de9123b85088ceebf0e141e09c5abf532c21452 (diff) | |
| download | php-git-750e4e10117d75e536bdcfdf344a18aaf8637739.tar.gz | |
Fixed bug #55578 (Segfault on implode/concat)
| -rw-r--r-- | Zend/tests/bug55578.phpt | 20 | ||||
| -rw-r--r-- | Zend/zend.c | 13 |
2 files changed, 31 insertions, 2 deletions
diff --git a/Zend/tests/bug55578.phpt b/Zend/tests/bug55578.phpt new file mode 100644 index 0000000000..4a8604a23b --- /dev/null +++ b/Zend/tests/bug55578.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #55578 (Segfault on implode/concat) +--FILE-- +<?php +$options = array(); + +class Foo { + public function __toString() { + return 'Foo'; + } +} + +function test($options, $queryPart) { + return ''. (0 ? 1 : $queryPart); +} + +var_dump(test($options, new Foo())); +?> +--EXPECT-- +string(3) "Foo" diff --git a/Zend/zend.c b/Zend/zend.c index c6f57aa37b..a8617e1a23 100644 --- a/Zend/zend.c +++ b/Zend/zend.c @@ -257,8 +257,17 @@ ZEND_API void zend_make_printable_zval(zval *expr, zval *expr_copy, int *use_cop { TSRMLS_FETCH(); - if (Z_OBJ_HANDLER_P(expr, cast_object) && Z_OBJ_HANDLER_P(expr, cast_object)(expr, expr_copy, IS_STRING TSRMLS_CC) == SUCCESS) { - break; + if (Z_OBJ_HANDLER_P(expr, cast_object)) { + zval *val; + + ALLOC_ZVAL(val); + INIT_PZVAL_COPY(val, expr); + zval_copy_ctor(val); + if (Z_OBJ_HANDLER_P(expr, cast_object)(val, expr_copy, IS_STRING TSRMLS_CC) == SUCCESS) { + zval_ptr_dtor(&val); + break; + } + zval_ptr_dtor(&val); } /* Standard PHP objects */ if (Z_OBJ_HT_P(expr) == &std_object_handlers || !Z_OBJ_HANDLER_P(expr, cast_object)) { |