diff options
| -rw-r--r-- | Zend/tests/bug47572.phpt | 17 | ||||
| -rw-r--r-- | Zend/zend_execute_API.c | 8 |
2 files changed, 22 insertions, 3 deletions
diff --git a/Zend/tests/bug47572.phpt b/Zend/tests/bug47572.phpt new file mode 100644 index 0000000000..695cc3a7f9 --- /dev/null +++ b/Zend/tests/bug47572.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #47572 (zval_update_constant_ex: Segmentation fault) +--FILE-- +<?php + +class Foo { + public static $bar = array( + FOO => "bar" + ); + +} + +$foo = new Foo(); + +?> +--EXPECTF-- +Notice: Use of undefined constant FOO - assumed 'FOO' in %s on line %d diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 36240eefce..f0f823719b 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -575,7 +575,7 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco } else if (Z_TYPE_P(p) == IS_CONSTANT_ARRAY) { zval **element, *new_val; char *str_index; - uint str_index_len; + uint str_index_len = 0; ulong num_index; int ret; @@ -613,9 +613,11 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco str_index = colon; } else { if (str_index[str_index_len - 2] & IS_CONSTANT_UNQUALIFIED) { - actual = (char *)zend_memrchr(str_index, '\\', str_index_len - 3) + 1; + if ((actual = (char *)zend_memrchr(str_index, '\\', str_index_len - 3))) { + actual++; str_index_len -= (actual - str_index); - str_index = actual; + str_index = save; + } } if (str_index[0] == '\\') { ++str_index; |