cvs: ZendEngine2(PHP_5_2) / zend_compile.c zend_compile.h zend_vm_def.h zend_vm_execute.h /tests bug47165.phpt php-src NEWS
[email protected] ("Dmitry Stogov") Wed, 21 Jan 2009 10:15:57 -0000
| Newsgroups | php.zend-engine.cvs |
|---|---|
| Message-ID | <cvsdmitry1232532957@cvsserver> |
dmitry Wed Jan 21 10:15:57 2009 UTC
Added files: (Branch: PHP_5_2)
/ZendEngine2/tests bug47165.phpt
Modified files:
/php-src NEWS
/ZendEngine2 zend_compile.c zend_compile.h zend_vm_def.h
zend_vm_execute.h
Log:
Fixed bug #47165 (Possible memory corruption when passing return value by reference)
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1398&r2=1.2027.2.547.2.1399&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.1398 php-src/NEWS:1.2027.2.547.2.1399
--- php-src/NEWS:1.2027.2.547.2.1398 Tue Jan 20 15:43:06 2009
+++ php-src/NEWS Wed Jan 21 10:15:42 2009
@@ -17,6 +17,8 @@
- Fixed bug in xml_error_string() which resulted in messages being
off by one. (Scott)
+- Fixed bug #47165 (Possible memory corruption when passing return value by
+ reference). (Dmitry)
- Fixed bug #47152 (gzseek/fseek using SEEK_END produces strange results).
(Felipe)
- Fixed bug #47131 (SOAP Extension ignores "user_agent" ini setting). (Ilia)
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.c?r1=1.647.2.27.2.52&r2=1.647.2.27.2.53&diff_format=u
Index: ZendEngine2/zend_compile.c
diff -u ZendEngine2/zend_compile.c:1.647.2.27.2.52 ZendEngine2/zend_compile.c:1.647.2.27.2.53
--- ZendEngine2/zend_compile.c:1.647.2.27.2.52 Wed Dec 31 11:17:33 2008
+++ ZendEngine2/zend_compile.c Wed Jan 21 10:15:44 2009
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_compile.c,v 1.647.2.27.2.52 2008/12/31 11:17:33 sebastian Exp $ */
+/* $Id: zend_compile.c,v 1.647.2.27.2.53 2009/01/21 10:15:44 dmitry Exp $ */
#include <zend_language_parser.h>
#include "zend.h"
@@ -1607,8 +1607,17 @@
if (function_ptr) {
if (ARG_MAY_BE_SENT_BY_REF(function_ptr, (zend_uint) offset)) {
- op = (param->op_type & (IS_VAR|IS_CV))?ZEND_SEND_REF:ZEND_SEND_VAL;
- send_by_reference = 0;
+ if (param->op_type & (IS_VAR|IS_CV)) {
+ send_by_reference = 1;
+ if (op == ZEND_SEND_VAR && zend_is_function_or_method_call(param)) {
+ /* Method call */
+ op = ZEND_SEND_VAR_NO_REF;
+ send_function = ZEND_ARG_SEND_FUNCTION | ZEND_ARG_SEND_SILENT;
+ }
+ } else {
+ op = ZEND_SEND_VAL;
+ send_by_reference = 0;
+ }
} else {
send_by_reference = ARG_SHOULD_BE_SENT_BY_REF(function_ptr, (zend_uint) offset) ? ZEND_ARG_SEND_BY_REF : 0;
}
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_compile.h?r1=1.316.2.8.2.15&r2=1.316.2.8.2.16&diff_format=u
Index: ZendEngine2/zend_compile.h
diff -u ZendEngine2/zend_compile.h:1.316.2.8.2.15 ZendEngine2/zend_compile.h:1.316.2.8.2.16
--- ZendEngine2/zend_compile.h:1.316.2.8.2.15 Wed Dec 31 11:17:33 2008
+++ ZendEngine2/zend_compile.h Wed Jan 21 10:15:46 2009
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_compile.h,v 1.316.2.8.2.15 2008/12/31 11:17:33 sebastian Exp $ */
+/* $Id: zend_compile.h,v 1.316.2.8.2.16 2009/01/21 10:15:46 dmitry Exp $ */
#ifndef ZEND_COMPILE_H
#define ZEND_COMPILE_H
@@ -659,6 +659,7 @@
#define ZEND_ARG_SEND_BY_REF (1<<0)
#define ZEND_ARG_COMPILE_TIME_BOUND (1<<1)
#define ZEND_ARG_SEND_FUNCTION (1<<2)
+#define ZEND_ARG_SEND_SILENT (1<<3)
#define ZEND_SEND_BY_VAL 0
#define ZEND_SEND_BY_REF 1
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_vm_def.h?r1=1.59.2.29.2.63&r2=1.59.2.29.2.64&diff_format=u
Index: ZendEngine2/zend_vm_def.h
diff -u ZendEngine2/zend_vm_def.h:1.59.2.29.2.63 ZendEngine2/zend_vm_def.h:1.59.2.29.2.64
--- ZendEngine2/zend_vm_def.h:1.59.2.29.2.63 Thu Jan 15 08:48:40 2009
+++ ZendEngine2/zend_vm_def.h Wed Jan 21 10:15:46 2009
@@ -18,7 +18,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_vm_def.h,v 1.59.2.29.2.63 2009/01/15 08:48:40 dmitry Exp $ */
+/* $Id: zend_vm_def.h,v 1.59.2.29.2.64 2009/01/21 10:15:46 dmitry Exp $ */
/* If you change this file, please regenerate the zend_vm_execute.h and
* zend_vm_opcodes.h files by running:
@@ -2331,7 +2331,9 @@
} else {
zval *valptr;
- zend_error(E_STRICT, "Only variables should be passed by reference");
+ if (!(opline->extended_value & ZEND_ARG_SEND_SILENT)) {
+ zend_error(E_STRICT, "Only variables should be passed by reference");
+ }
ALLOC_ZVAL(valptr);
INIT_PZVAL_COPY(valptr, varptr);
if (!IS_OP1_TMP_FREE()) {
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_vm_execute.h?r1=1.62.2.30.2.66&r2=1.62.2.30.2.67&diff_format=u
Index: ZendEngine2/zend_vm_execute.h
diff -u ZendEngine2/zend_vm_execute.h:1.62.2.30.2.66 ZendEngine2/zend_vm_execute.h:1.62.2.30.2.67
--- ZendEngine2/zend_vm_execute.h:1.62.2.30.2.66 Thu Jan 15 08:48:40 2009
+++ ZendEngine2/zend_vm_execute.h Wed Jan 21 10:15:46 2009
@@ -7554,7 +7554,9 @@
} else {
zval *valptr;
- zend_error(E_STRICT, "Only variables should be passed by reference");
+ if (!(opline->extended_value & ZEND_ARG_SEND_SILENT)) {
+ zend_error(E_STRICT, "Only variables should be passed by reference");
+ }
ALLOC_ZVAL(valptr);
INIT_PZVAL_COPY(valptr, varptr);
if (!0) {
@@ -19876,7 +19878,9 @@
} else {
zval *valptr;
- zend_error(E_STRICT, "Only variables should be passed by reference");
+ if (!(opline->extended_value & ZEND_ARG_SEND_SILENT)) {
+ zend_error(E_STRICT, "Only variables should be passed by reference");
+ }
ALLOC_ZVAL(valptr);
INIT_PZVAL_COPY(valptr, varptr);
if (!0) {
http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug47165.phpt?view=markup&rev=1.1
Index: ZendEngine2/tests/bug47165.phpt
+++ ZendEngine2/tests/bug47165.phpt