mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-18 14:30:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #60611 (Segmentation fault with Cls::{expr}() syntax)

Browse Source
This commit is contained in:
Xinchen Hui 2011-12-27 08:38:18 +00:00
parent c3044c9fcf
commit 20e2db2ce3
2 changed files with 36 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
Zend/tests/bug60611.phpt Normal file
View File

@ -0,0 +1,28 @@
--TEST--
Bug #60611 (Segmentation fault with Cls::{expr}() syntax)
--FILE--
<?php
class Cls {
function __call($name, $arg) {
}
static function __callStatic($name, $arg) {
}
}
Cls::{0}();
Cls::{1.0}();
Cls::{true}();
Cls::{false}();
Cls::{null}();
$cls = new Cls;
$cls->{0}();
$cls->{1.0}();
$cls->{true}();
$cls->{false}();
$cls->{null}();
echo "done";
?>
--EXPECT--
done

11
Zend/zend_compile.c
View File

@ -1973,9 +1973,10 @@ void zend_do_begin_method_call(znode *left_bracket TSRMLS_DC) /* {{{ */
if (last_op->opcode == ZEND_FETCH_OBJ_R) {
if (last_op->op2_type == IS_CONST) {
zval name;
name = CONSTANT(last_op->op2.constant);
if (!IS_INTERNED(Z_STRVAL(name))) {
if (Z_TYPE(name) != IS_STRING) {
convert_to_string(&name);
} else if (!IS_INTERNED(Z_STRVAL(name))) {
Z_STRVAL(name) = estrndup(Z_STRVAL(name), Z_STRLEN(name));
}
FREE_POLYMORPHIC_CACHE_SLOT(last_op->op2.constant);
@ -2367,7 +2368,11 @@ int zend_do_begin_class_member_function_call(znode *class_name, znode *method_na
zend_op *opline;
if (method_name->op_type == IS_CONST) {
char *lcname = zend_str_tolower_dup(Z_STRVAL(method_name->u.constant), Z_STRLEN(method_name->u.constant));
char *lcname;
if (Z_TYPE(method_name->u.constant) != IS_STRING) {
convert_to_string(&method_name->u.constant);
}
lcname = zend_str_tolower_dup(Z_STRVAL(method_name->u.constant), Z_STRLEN(method_name->u.constant));
if ((sizeof(ZEND_CONSTRUCTOR_FUNC_NAME)-1) == Z_STRLEN(method_name->u.constant) &&
memcmp(lcname, ZEND_CONSTRUCTOR_FUNC_NAME, sizeof(ZEND_CONSTRUCTOR_FUNC_NAME)-1) == 0) {
zval_dtor(&method_name->u.constant);