diff options
| author | Xinchen Hui <laruence@gmail.com> | 2017-02-12 20:36:43 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2017-02-12 20:36:43 +0800 |
| commit | 963981df5898ceb2626d454e2825270c4c977718 (patch) | |
| tree | e09f8f8d63431e8eb42514aec07cfe5e00d67149 /Zend/zend_operators.c | |
| parent | fb22a0f48ddce9950094b309ac6fb49928730863 (diff) | |
| parent | b96c5b14b9d0ee6f90bdb7d1c0815b7f6b5109cd (diff) | |
| download | php-git-963981df5898ceb2626d454e2825270c4c977718.tar.gz | |
Merge branch 'PHP-7.1'
* PHP-7.1:
Update NEWS
Fixed bug #74084 (Out of bound read - zend_mm_alloc_small)
Diffstat (limited to 'Zend/zend_operators.c')
| -rw-r--r-- | Zend/zend_operators.c | 66 |
1 files changed, 48 insertions, 18 deletions
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c index fd15e8e9d6..37fa5e9825 100644 --- a/Zend/zend_operators.c +++ b/Zend/zend_operators.c @@ -941,8 +941,13 @@ ZEND_API int ZEND_FASTCALL add_function(zval *result, zval *op1, zval *op2) /* { } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_ADD, add_function); - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { if (result != op1) { @@ -986,8 +991,13 @@ ZEND_API int ZEND_FASTCALL sub_function(zval *result, zval *op1, zval *op2) /* { } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_SUB, sub_function); - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { if (result != op1) { @@ -1036,8 +1046,13 @@ ZEND_API int ZEND_FASTCALL mul_function(zval *result, zval *op1, zval *op2) /* { } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_MUL, mul_function); - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { if (result != op1) { @@ -1117,17 +1132,27 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* { } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_POW, pow_function); - if (Z_TYPE_P(op1) == IS_ARRAY) { - ZVAL_LONG(result, 0); - return SUCCESS; - } else { - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - } - if (Z_TYPE_P(op2) == IS_ARRAY) { - ZVAL_LONG(result, 1L); - return SUCCESS; + if (EXPECTED(op1 != op2)) { + if (Z_TYPE_P(op1) == IS_ARRAY) { + ZVAL_LONG(result, 0); + return SUCCESS; + } else { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + } + if (Z_TYPE_P(op2) == IS_ARRAY) { + ZVAL_LONG(result, 1L); + return SUCCESS; + } else { + zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } } else { - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (Z_TYPE_P(op1) == IS_ARRAY) { + ZVAL_LONG(result, 0); + return SUCCESS; + } else { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + } + op2 = op1; } converted = 1; } else { @@ -1195,8 +1220,13 @@ ZEND_API int ZEND_FASTCALL div_function(zval *result, zval *op1, zval *op2) /* { } else if (!converted) { ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_DIV, div_function); - zendi_convert_scalar_to_number(op1, op1_copy, result, 0); - zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + if (EXPECTED(op1 != op2)) { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + zendi_convert_scalar_to_number(op2, op2_copy, result, 0); + } else { + zendi_convert_scalar_to_number(op1, op1_copy, result, 0); + op2 = op1; + } converted = 1; } else { if (result != op1) { |