diff options
| author | Nikita Popov <nikic@php.net> | 2015-07-06 20:53:54 +0200 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2015-07-06 20:53:54 +0200 |
| commit | 724051e3bd0b8618edd1dd3f29f27939efefff08 (patch) | |
| tree | c70ade764924aa2b5b6d5741409b7a9e38439746 /Zend/zend_execute.c | |
| parent | 89ce8d28dee671eead485077bc97c2b800790d68 (diff) | |
| download | php-git-724051e3bd0b8618edd1dd3f29f27939efefff08.tar.gz | |
Fix crash when exception occurs during nested rope
Adds extra condition that the rope var of INIT/ADD must match the
one one END.
Diffstat (limited to 'Zend/zend_execute.c')
| -rw-r--r-- | Zend/zend_execute.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 88d0135cfc..6122566b3e 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -2522,7 +2522,8 @@ static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data } else if (brk_opline->opcode == ZEND_ROPE_END) { zend_string **rope = (zend_string **) EX_VAR(brk_opline->op1.var); zend_op *last = EX(func)->op_array.opcodes + op_num; - while (last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT) { + while ((last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT) + || last->result.var != brk_opline->op1.var) { ZEND_ASSERT(last >= EX(func)->op_array.opcodes); last--; } |