cvs: ZendEngine2(PHP_5_2) / zend_execute.c

dmitry		Tue Mar  4 11:48:53 2008 UTC

  Modified files:              (Branch: PHP_5_2)
    /ZendEngine2	zend_execute.c 
  Log:
  Fixed wrong result of cascading assignment to string offset
  Fixed memory corruption on cascading assignment of IS_TMP_VAR into string offset
  Fixed opcode caches shared memory corruption on cascading assignment of IS_CONST into string offset
  
  
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_execute.c?r1=1.716.2.12.2.27&r2=1.716.2.12.2.28&diff_format=u
Index: ZendEngine2/zend_execute.c
diff -u ZendEngine2/zend_execute.c:1.716.2.12.2.27 ZendEngine2/zend_execute.c:1.716.2.12.2.28
--- ZendEngine2/zend_execute.c:1.716.2.12.2.27	Mon Feb 18 12:11:34 2008
+++ ZendEngine2/zend_execute.c	Tue Mar  4 11:48:53 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_execute.c,v 1.716.2.12.2.27 2008/02/18 12:11:34 dmitry Exp $ */
+/* $Id: zend_execute.c,v 1.716.2.12.2.28 2008/03/04 11:48:53 dmitry Exp $ */
 
 #define ZEND_INTENSIVE_DEBUGGING 0
 
@@ -645,7 +645,13 @@
 
 			if (((int)T->str_offset.offset < 0)) {
 				zend_error(E_WARNING, "Illegal string offset:  %d", T->str_offset.offset);
-				break;
+				if (!RETURN_VALUE_UNUSED(result)) {
+					T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
+					PZVAL_LOCK(*T(result->u.var).var.ptr_ptr);
+					AI_USE_PTR(T(result->u.var).var);
+				}
+				FREE_OP_VAR_PTR(free_op1);
+				return;
 			}
 			if (T->str_offset.offset >= Z_STRLEN_P(T->str_offset.str)) {
 				zend_uint i;
@@ -665,7 +671,7 @@
 
 			if (Z_TYPE_P(value)!=IS_STRING) {
 				tmp = *value;
-				if (op2->op_type & (IS_VAR|IS_CV)) {
+				if (op2->op_type != IS_TMP_VAR) {
 					zval_copy_ctor(&tmp);
 				}
 				convert_to_string(&tmp);
@@ -674,16 +680,13 @@
 
 			Z_STRVAL_P(T->str_offset.str)[T->str_offset.offset] = Z_STRVAL_P(final_value)[0];
 
-			if (op2->op_type == IS_TMP_VAR) {
-				if (final_value == &T(op2->u.var).tmp_var) {
-					/* we can safely free final_value here
-					 * because separation is done only
-					 * in case op2->op_type == IS_VAR */
-					STR_FREE(Z_STRVAL_P(final_value));
-				}
-			}
 			if (final_value == &tmp) {
 				zval_dtor(final_value);
+			} else if (op2->op_type == IS_TMP_VAR) {
+				/* we can safely free final_value here
+				 * because separation is done only
+				 * in case op2->op_type == IS_VAR */
+				STR_FREE(Z_STRVAL_P(final_value));
 			}
 			/*
 			 * the value of an assignment to a string offset is undefined
@@ -692,11 +695,11 @@
 		} while (0);
 		/* zval_ptr_dtor(&T->str_offset.str); Nuke this line if it doesn't cause a leak */
 
-/*		T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr); */
 		if (!RETURN_VALUE_UNUSED(result)) {
-			T(result->u.var).var.ptr_ptr = &value;
-			PZVAL_LOCK(*T(result->u.var).var.ptr_ptr);
-			AI_USE_PTR(T(result->u.var).var);
+			T(result->u.var).var.ptr_ptr = &T(result->u.var).var.ptr;
+			ALLOC_ZVAL(T(result->u.var).var.ptr);
+			INIT_PZVAL(T(result->u.var).var.ptr);
+			ZVAL_STRINGL(T(result->u.var).var.ptr, Z_STRVAL_P(T->str_offset.str)+T->str_offset.offset, 1, 1);
 		}
 		FREE_OP_VAR_PTR(free_op1);
 		return;