diff options
| author | Dmitry Stogov <dmitry@php.net> | 2005-02-20 10:19:11 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2005-02-20 10:19:11 +0000 |
| commit | 57d2c2bb83564e13eb27c08b6b7604b1a05a64a5 (patch) | |
| tree | 7857daffff024370004d37451fc00a4c43a72fcb /Zend/zend_compile.c | |
| parent | 8f2cfb9d4edd40897925ef5dd4158c9aa3cece2e (diff) | |
| download | php-git-57d2c2bb83564e13eb27c08b6b7604b1a05a64a5.tar.gz | |
Fixed possible memory corruption
Diffstat (limited to 'Zend/zend_compile.c')
| -rw-r--r-- | Zend/zend_compile.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 2750fc8c55..32f2a3c26a 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -3424,7 +3424,7 @@ void zend_do_foreach_fetch(znode *foreach_token, znode *open_brackets_token, zno void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, znode *key TSRMLS_DC) { zend_op *opline; - znode dummy; + znode dummy, value_node; zend_bool assign_by_ref=0; opline = &CG(active_op_array)->opcodes[as_token->u.opline_num]; @@ -3453,21 +3453,25 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z opline->extended_value |= ZEND_FE_FETCH_BYREF; } + value_node = opline->result; if (assign_by_ref) { /* Mark FE_FETCH as IS_VAR as it holds the data directly as a value */ - zend_do_assign_ref(NULL, value, &opline->result TSRMLS_CC); + zend_do_assign_ref(NULL, value, &value_node TSRMLS_CC); } else { - zend_do_assign(&dummy, value, &opline->result TSRMLS_CC); + zend_do_assign(&dummy, value, &value_node TSRMLS_CC); zend_do_free(&dummy TSRMLS_CC); } if (key->op_type != IS_UNUSED) { + znode key_node; + opline = &CG(active_op_array)->opcodes[as_token->u.opline_num+1]; opline->result.op_type = IS_TMP_VAR; opline->result.u.EA.type = 0; opline->result.u.opline_num = get_temporary_variable(CG(active_op_array)); + key_node = opline->result; - zend_do_assign(&dummy, key, &opline->result TSRMLS_CC); + zend_do_assign(&dummy, key, &key_node TSRMLS_CC); zend_do_free(&dummy TSRMLS_CC); } |