com php-src: Merge branch 'PHP-7.0' into PHP-7.1: Zend/zend_o perators.c

Commit:    b56114e8fb90098e4f56e8bea92c8d5450a76483
Author:    Xinchen Hui <[email protected]>         Sun, 12 Feb 2017 20:36:18 +0800
Parents:   98fceaf61eff17d98926f3e6f8f39301066ca001 26fdebc63b642417820017e550d46c1b1f773504
Branches:  PHP-7.1 master

Link:       http://git.php.net/?p=php-src.git;a=commitdiff;h=b56114e8fb90098e4f56e8bea92c8d5450a76483

Log:
Merge branch 'PHP-7.0' into PHP-7.1

* PHP-7.0:
  Fixed bug #74084 (Out of bound read - zend_mm_alloc_small)

Conflicts:
	Zend/zend_operators.c

Bugs:
https://bugs.php.net/74084

Changed paths:
  MM  Zend/zend_operators.c


Diff:
diff --cc Zend/zend_operators.c
index f2213c1,3a8929b..418d2f0
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@@ -951,8 -926,13 +951,13 @@@ ZEND_API int ZEND_FASTCALL add_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_ADD, add_function);
  
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");
@@@ -993,8 -984,13 +998,13 @@@ ZEND_API int ZEND_FASTCALL sub_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_SUB, sub_function);
  
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");
@@@ -1040,8 -1036,13 +1050,13 @@@ ZEND_API int ZEND_FASTCALL mul_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_MUL, mul_function);
  
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");
@@@ -1118,17 -1119,27 +1133,27 @@@ ZEND_API int ZEND_FASTCALL pow_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_POW, pow_function);
  
- 					if (Z_TYPE_P(op1) == IS_ARRAY) {
- 						ZVAL_LONG(result, 0);
- 						return SUCCESS;
- 					} else {
- 						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					}
- 					if (Z_TYPE_P(op2) == IS_ARRAY) {
- 						ZVAL_LONG(result, 1L);
- 						return SUCCESS;
+ 					if (EXPECTED(op1 != op2)) {
+ 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+ 							ZVAL_LONG(result, 0);
+ 							return SUCCESS;
+ 						} else {
 -							zendi_convert_scalar_to_number(op1, op1_copy, result);
++							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						}
+ 						if (Z_TYPE_P(op2) == IS_ARRAY) {
+ 							ZVAL_LONG(result, 1L);
+ 							return SUCCESS;
+ 						} else {
 -							zendi_convert_scalar_to_number(op2, op2_copy, result);
++							zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 						}
  					} else {
- 						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+ 							ZVAL_LONG(result, 0);
+ 							return SUCCESS;
+ 						} else {
 -							zendi_convert_scalar_to_number(op1, op1_copy, result);
++							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						}
+ 						op2 = op1;
  					}
  					converted = 1;
  				} else {
@@@ -1192,9 -1203,13 +1217,14 @@@ ZEND_API int ZEND_FASTCALL div_function
  					op2 = Z_REFVAL_P(op2);
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_DIV, div_function);
 +
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");