cvs: ZendEngine2 / zend_compile.c /tests bug47165.phpt php-src/ext/standard/tests/array extract_variation9.phpt

dmitry		Tue Jan 20 11:23:04 2009 UTC

  Modified files:              
    /php-src/ext/standard/tests/array	extract_variation9.phpt 
    /ZendEngine2	zend_compile.c 
    /ZendEngine2/tests	bug47165.phpt 
  Log:
  Fixed bug #47165 (Possible memory corruption when passing return value by reference)
  
  
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/array/extract_variation9.phpt?r1=1.3&r2=1.4&diff_format=u
Index: php-src/ext/standard/tests/array/extract_variation9.phpt
diff -u php-src/ext/standard/tests/array/extract_variation9.phpt:1.3 php-src/ext/standard/tests/array/extract_variation9.phpt:1.4
--- php-src/ext/standard/tests/array/extract_variation9.phpt:1.3	Mon May 26 23:35:48 2008
+++ php-src/ext/standard/tests/array/extract_variation9.phpt	Tue Jan 20 11:23:03 2009
@@ -14,7 +14,9 @@
 
 echo "Done\n";
 ?>
---EXPECT--
+--EXPECTF--
 *** Testing for object ***
+
+Strict Standards: Only variables should be passed by reference in %sextract_variation9.php on line 10
 int(1)
 Done
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.c?r1=1.848&r2=1.849&diff_format=u
Index: ZendEngine2/zend_compile.c
diff -u ZendEngine2/zend_compile.c:1.848 ZendEngine2/zend_compile.c:1.849
--- ZendEngine2/zend_compile.c:1.848	Wed Jan 14 13:57:59 2009
+++ ZendEngine2/zend_compile.c	Tue Jan 20 11:23:04 2009
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_compile.c,v 1.848 2009/01/14 13:57:59 dmitry Exp $ */
+/* $Id: zend_compile.c,v 1.849 2009/01/20 11:23:04 dmitry Exp $ */
 
 #include <zend_language_parser.h>
 #include "zend.h"
@@ -2213,8 +2213,17 @@
 		send_by_reference = 1;
 	} else if (function_ptr) {
 		if (ARG_MAY_BE_SENT_BY_REF(function_ptr, (zend_uint) offset)) {
-			op = (param->op_type & (IS_VAR|IS_CV))?ZEND_SEND_REF:ZEND_SEND_VAL;
-			send_by_reference = 0;
+			if (param->op_type & (IS_VAR|IS_CV)) {
+				send_by_reference = 1;
+				if (op == ZEND_SEND_VAR && zend_is_function_or_method_call(param)) {
+					/* Method call */
+					op = ZEND_SEND_VAR_NO_REF;
+					send_function = ZEND_ARG_SEND_FUNCTION;
+				}
+			} else {
+				op = ZEND_SEND_VAL;
+				send_by_reference = 0;
+			}
 		} else {
 			send_by_reference = ARG_SHOULD_BE_SENT_BY_REF(function_ptr, (zend_uint) offset) ? ZEND_ARG_SEND_BY_REF : 0;
 		}
http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug47165.phpt?r1=1.1&r2=1.2&diff_format=u
Index: ZendEngine2/tests/bug47165.phpt
diff -u /dev/null ZendEngine2/tests/bug47165.phpt:1.2
--- /dev/null	Tue Jan 20 11:23:04 2009
+++ ZendEngine2/tests/bug47165.phpt	Tue Jan 20 11:23:04 2009
@@ -0,0 +1,20 @@
+--TEST--
+Bug #47165 (Possible memory corruption when passing return value by reference)
+--FILE--
+<?php
+class Foo {
+	var $bar = array();
+
+	static function bar() {
+		static $instance = null;
+		$instance = new Foo();
+		return $instance->bar;
+	}
+}
+extract(Foo::bar());
+echo "ok\n";
+?>
+--EXPECTF--
+
+Strict Standards: Only variables should be passed by reference in %sbug47165.php on line 11
+ok