cvs: ZendEngine2(PHP_5_3) / zend_compile.c

stas		Wed Nov 12 00:44:57 2008 UTC

  Modified files:              (Branch: PHP_5_3)
    /ZendEngine2	zend_compile.c 
  Log:
  fix potential crash in zend_do_assign due to opcodes realloc
  
  
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.c?r1=1.647.2.27.2.41.2.91&r2=1.647.2.27.2.41.2.92&diff_format=u
Index: ZendEngine2/zend_compile.c
diff -u ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.91 ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.92
--- ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.91	Wed Nov 12 00:23:21 2008
+++ ZendEngine2/zend_compile.c	Wed Nov 12 00:44:56 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_compile.c,v 1.647.2.27.2.41.2.91 2008/11/12 00:23:21 stas Exp $ */
+/* $Id: zend_compile.c,v 1.647.2.27.2.41.2.92 2008/11/12 00:44:56 stas Exp $ */
 
 #include <zend_language_parser.h>
 #include "zend.h"
@@ -609,10 +609,13 @@
 			    last_op->result.u.var == variable->u.var) {
 				if (last_op->opcode == ZEND_FETCH_OBJ_W) {
 					if (n > 0) {
+						int opline_no = (opline-CG(active_op_array)->opcodes)/sizeof(*opline);
 						*opline = *last_op;
 						MAKE_NOP(last_op);
-						last_op = opline;
+						/* last_op = opline; */
 						opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+						/* get_next_op can realloc, we need to move last_op */
+						last_op = &CG(active_op_array)->opcodes[opline_no];
 					}
 					last_op->opcode = ZEND_ASSIGN_OBJ;
 					zend_do_op_data(opline, value TSRMLS_CC);
@@ -621,10 +624,14 @@
 					return;
 				} else if (last_op->opcode == ZEND_FETCH_DIM_W) {
 					if (n > 0) {
+						int opline_no = (opline-CG(active_op_array)->opcodes)/sizeof(*opline);
 						*opline = *last_op;
 						MAKE_NOP(last_op);
-						last_op = opline;
+						/* last_op = opline; */
+						/* TBFixed: this can realloc opcodes, leaving last_op pointing wrong */
 						opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+						/* get_next_op can realloc, we need to move last_op */
+						last_op = &CG(active_op_array)->opcodes[opline_no];
 					}
 					last_op->opcode = ZEND_ASSIGN_DIM;
 					zend_do_op_data(opline, value TSRMLS_CC);