diff options
| author | Dmitry Stogov <dmitry@php.net> | 2011-07-11 10:31:49 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2011-07-11 10:31:49 +0000 |
| commit | ac1ae51a3865c24bb452991714c7efe4c05e7eb1 (patch) | |
| tree | f07b2eb3870492b812223ffe49640c22ece66f9e /Zend/zend_vm_execute.h | |
| parent | 7d1eef4aa7cf05ae0141146a8fc72d12e566a975 (diff) | |
| download | php-git-ac1ae51a3865c24bb452991714c7efe4c05e7eb1.tar.gz | |
Fixed bug #54305 (Crash in gc_remove_zval_from_buffer)
Diffstat (limited to 'Zend/zend_vm_execute.h')
| -rw-r--r-- | Zend/zend_vm_execute.h | 56 |
1 files changed, 40 insertions, 16 deletions
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 7ebde2f092..3892c8a9e9 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -1324,10 +1324,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zval *z = &opline->op1.u.constant; if (IS_CONST != IS_CONST && - Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL && - zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { - zend_print_variable(&z_copy); - zval_dtor(&z_copy); + Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) { + if (IS_CONST == IS_TMP_VAR) { + INIT_PZVAL(z); + } + if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { + zend_print_variable(&z_copy); + zval_dtor(&z_copy); + } else { + zend_print_variable(z); + } } else { zend_print_variable(z); } @@ -4614,10 +4620,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zval *z = _get_zval_ptr_tmp(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); if (IS_TMP_VAR != IS_CONST && - Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL && - zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { - zend_print_variable(&z_copy); - zval_dtor(&z_copy); + Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) { + if (IS_TMP_VAR == IS_TMP_VAR) { + INIT_PZVAL(z); + } + if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { + zend_print_variable(&z_copy); + zval_dtor(&z_copy); + } else { + zend_print_variable(z); + } } else { zend_print_variable(z); } @@ -7870,10 +7882,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zval *z = _get_zval_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); if (IS_VAR != IS_CONST && - Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL && - zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { - zend_print_variable(&z_copy); - zval_dtor(&z_copy); + Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) { + if (IS_VAR == IS_TMP_VAR) { + INIT_PZVAL(z); + } + if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { + zend_print_variable(&z_copy); + zval_dtor(&z_copy); + } else { + zend_print_variable(z); + } } else { zend_print_variable(z); } @@ -21767,10 +21785,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zval *z = _get_zval_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC); if (IS_CV != IS_CONST && - Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL && - zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { - zend_print_variable(&z_copy); - zval_dtor(&z_copy); + Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get_method != NULL) { + if (IS_CV == IS_TMP_VAR) { + INIT_PZVAL(z); + } + if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) { + zend_print_variable(&z_copy); + zval_dtor(&z_copy); + } else { + zend_print_variable(z); + } } else { zend_print_variable(z); } |