cvs: ZendEngine2(PHP_5_3) / zend_compile.c /tests bug47165.phpt php-src NEWS php-src/ext/standard/tests/array extract_variation9.phpt

dmitry		Tue Jan 20 11:22:47 2009 UTC

  Added files:                 (Branch: PHP_5_3)
    /ZendEngine2/tests	bug47165.phpt 

  Modified files:              
    /php-src	NEWS 
    /php-src/ext/standard/tests/array	extract_variation9.phpt 
    /ZendEngine2	zend_compile.c 
  Log:
  Fixed bug #47165 (Possible memory corruption when passing return value by reference)
  
  
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.965.2.469&r2=1.2027.2.547.2.965.2.470&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.965.2.469 php-src/NEWS:1.2027.2.547.2.965.2.470
--- php-src/NEWS:1.2027.2.547.2.965.2.469	Tue Jan 20 09:59:25 2009
+++ php-src/NEWS	Tue Jan 20 11:22:43 2009
@@ -48,6 +48,8 @@
 
 - Fixed building of pdo_sqlite without sqlite3. (Scott)
 
+- Fixed bug #47165 (Possible memory corruption when passing return value by
+  reference). (Dmitry)
 - Fixed bug #47145 + #47159 (Always free failed SQLite statements). (Scott)
 - Fixed bug #47141 (Unable to fetch error messages from SQLite
   when the database can't be opened). (Scott)
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/array/extract_variation9.phpt?r1=1.1.2.1&r2=1.1.2.1.2.1&diff_format=u
Index: php-src/ext/standard/tests/array/extract_variation9.phpt
diff -u php-src/ext/standard/tests/array/extract_variation9.phpt:1.1.2.1 php-src/ext/standard/tests/array/extract_variation9.phpt:1.1.2.1.2.1
--- php-src/ext/standard/tests/array/extract_variation9.phpt:1.1.2.1	Fri Aug 10 12:30:09 2007
+++ php-src/ext/standard/tests/array/extract_variation9.phpt	Tue Jan 20 11:22:44 2009
@@ -16,5 +16,7 @@
 ?>
 --EXPECTF--
 *** Testing for object ***
+
+Strict Standards: Only variables should be passed by reference in %sextract_variation9.php on line 10
 int(1)
 Done
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.c?r1=1.647.2.27.2.41.2.99&r2=1.647.2.27.2.41.2.100&diff_format=u
Index: ZendEngine2/zend_compile.c
diff -u ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.99 ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.100
--- ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.99	Wed Jan 14 13:57:42 2009
+++ ZendEngine2/zend_compile.c	Tue Jan 20 11:22:44 2009
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_compile.c,v 1.647.2.27.2.41.2.99 2009/01/14 13:57:42 dmitry Exp $ */
+/* $Id: zend_compile.c,v 1.647.2.27.2.41.2.100 2009/01/20 11:22:44 dmitry Exp $ */
 
 #include <zend_language_parser.h>
 #include "zend.h"
@@ -2128,8 +2128,17 @@
 
 	if (function_ptr) {
 		if (ARG_MAY_BE_SENT_BY_REF(function_ptr, (zend_uint) offset)) {
-			op = (param->op_type & (IS_VAR|IS_CV))?ZEND_SEND_REF:ZEND_SEND_VAL;
-			send_by_reference = 0;
+			if (param->op_type & (IS_VAR|IS_CV)) {
+				send_by_reference = 1;
+				if (op == ZEND_SEND_VAR && zend_is_function_or_method_call(param)) {
+					/* Method call */
+					op = ZEND_SEND_VAR_NO_REF;
+					send_function = ZEND_ARG_SEND_FUNCTION;
+				}
+			} else {
+				op = ZEND_SEND_VAL;
+				send_by_reference = 0;
+			}
 		} else {
 			send_by_reference = ARG_SHOULD_BE_SENT_BY_REF(function_ptr, (zend_uint) offset) ? ZEND_ARG_SEND_BY_REF : 0;
 		}

http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug47165.phpt?view=markup&rev=1.1
Index: ZendEngine2/tests/bug47165.phpt
+++ ZendEngine2/tests/bug47165.phpt