Re: [ZEND-ENGINE-CVS] cvs: ZendEngine2(PHP_5_3) / zend_compile.c /tests bug47165.phpt php-src NEWS php-src/ext/standard/tests/array extract_variation9.phpt

Dmitry Stogov wrote:
> dmitry		Tue Jan 20 11:22:47 2009 UTC
> 
>   Added files:                 (Branch: PHP_5_3)
>     /ZendEngine2/tests	bug47165.phpt 
> 
>   Modified files:              
>     /php-src	NEWS 
>     /php-src/ext/standard/tests/array	extract_variation9.phpt 
>     /ZendEngine2	zend_compile.c 
>   Log:
>   Fixed bug #47165 (Possible memory corruption when passing return value by reference)

Not gonna fix it in PHP_5_2 branch..? Hmm..YOU reported it? :D

--Jani


>   
> http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.965.2.469&r2=1.2027.2.547.2.965.2.470&diff_format=u
> Index: php-src/NEWS
> diff -u php-src/NEWS:1.2027.2.547.2.965.2.469 php-src/NEWS:1.2027.2.547.2.965.2.470
> --- php-src/NEWS:1.2027.2.547.2.965.2.469	Tue Jan 20 09:59:25 2009
> +++ php-src/NEWS	Tue Jan 20 11:22:43 2009
> @@ -48,6 +48,8 @@
>  
>  - Fixed building of pdo_sqlite without sqlite3. (Scott)
>  
> +- Fixed bug #47165 (Possible memory corruption when passing return value by
> +  reference). (Dmitry)
>  - Fixed bug #47145 + #47159 (Always free failed SQLite statements). (Scott)
>  - Fixed bug #47141 (Unable to fetch error messages from SQLite
>    when the database can't be opened). (Scott)
> http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/array/extract_variation9.phpt?r1=1.1.2.1&r2=1.1.2.1.2.1&diff_format=u
> Index: php-src/ext/standard/tests/array/extract_variation9.phpt
> diff -u php-src/ext/standard/tests/array/extract_variation9.phpt:1.1.2.1 php-src/ext/standard/tests/array/extract_variation9.phpt:1.1.2.1.2.1
> --- php-src/ext/standard/tests/array/extract_variation9.phpt:1.1.2.1	Fri Aug 10 12:30:09 2007
> +++ php-src/ext/standard/tests/array/extract_variation9.phpt	Tue Jan 20 11:22:44 2009
> @@ -16,5 +16,7 @@
>  ?>
>  --EXPECTF--
>  *** Testing for object ***
> +
> +Strict Standards: Only variables should be passed by reference in %sextract_variation9.php on line 10
>  int(1)
>  Done
> http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.c?r1=1.647.2.27.2.41.2.99&r2=1.647.2.27.2.41.2.100&diff_format=u
> Index: ZendEngine2/zend_compile.c
> diff -u ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.99 ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.100
> --- ZendEngine2/zend_compile.c:1.647.2.27.2.41.2.99	Wed Jan 14 13:57:42 2009
> +++ ZendEngine2/zend_compile.c	Tue Jan 20 11:22:44 2009
> @@ -17,7 +17,7 @@
>     +----------------------------------------------------------------------+
>  */
>  
> -/* $Id: zend_compile.c,v 1.647.2.27.2.41.2.99 2009/01/14 13:57:42 dmitry Exp $ */
> +/* $Id: zend_compile.c,v 1.647.2.27.2.41.2.100 2009/01/20 11:22:44 dmitry Exp $ */
>  
>  #include <zend_language_parser.h>
>  #include "zend.h"
> @@ -2128,8 +2128,17 @@
>  
>  	if (function_ptr) {
>  		if (ARG_MAY_BE_SENT_BY_REF(function_ptr, (zend_uint) offset)) {
> -			op = (param->op_type & (IS_VAR|IS_CV))?ZEND_SEND_REF:ZEND_SEND_VAL;
> -			send_by_reference = 0;
> +			if (param->op_type & (IS_VAR|IS_CV)) {
> +				send_by_reference = 1;
> +				if (op == ZEND_SEND_VAR && zend_is_function_or_method_call(param)) {
> +					/* Method call */
> +					op = ZEND_SEND_VAR_NO_REF;
> +					send_function = ZEND_ARG_SEND_FUNCTION;
> +				}
> +			} else {
> +				op = ZEND_SEND_VAL;
> +				send_by_reference = 0;
> +			}
>  		} else {
>  			send_by_reference = ARG_SHOULD_BE_SENT_BY_REF(function_ptr, (zend_uint) offset) ? ZEND_ARG_SEND_BY_REF : 0;
>  		}
> 
> http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug47165.phpt?view=markup&rev=1.1
> Index: ZendEngine2/tests/bug47165.phpt
> +++ ZendEngine2/tests/bug47165.phpt
> 
> 
>