mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 18:34:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #54305 (Crash in gc_remove_zval_from_buffer)

Browse Source
This commit is contained in:
Dmitry Stogov 2011-07-11 10:31:49 +00:00
parent adb87c8d06
commit a0974f2d59
3 changed files with 72 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
Zend/tests/bug54305.phpt Normal file
View File

@ -0,0 +1,22 @@
--TEST--
Bug #54305 (Crash in gc_remove_zval_from_buffer)
--FILE--
<?php
class TestClass {
public function methodWithArgs($a, $b) {
}
}
abstract class AbstractClass {
}
$methodWithArgs = new ReflectionMethod('TestClass', 'methodWithArgs');
echo $methodWithArgs++;
?>
--EXPECTF--
Method [ <user> public method methodWithArgs ] {
@@ %sbug54305.php %d - %d
- Parameters [2] {
Parameter #0 [ <required> $a ]
Parameter #1 [ <required> $b ]
}
}

14
Zend/zend_vm_def.h
View File

@ -982,10 +982,16 @@ ZEND_VM_HANDLER(40, ZEND_ECHO, CONST|TMP|VAR|CV, ANY)
if (OP1_TYPE != IS_CONST &&
UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) &&
Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_OBJ_HT_P(z)->get_method != NULL) {
if (OP1_TYPE == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}

56
Zend/zend_vm_execute.h
View File

@ -2012,10 +2012,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
if (IS_CONST != IS_CONST &&
UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) &&
Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_CONST == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}
@ -6278,10 +6284,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
if (IS_TMP_VAR != IS_CONST &&
UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) &&
Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_TMP_VAR == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}
@ -10455,10 +10467,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
if (IS_VAR != IS_CONST &&
UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) &&
Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_VAR == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}
@ -26192,10 +26210,16 @@ static int ZEND_FASTCALL ZEND_ECHO_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
if (IS_CV != IS_CONST &&
UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) &&
Z_OBJ_HT_P(z)->get_method != NULL &&
zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
Z_OBJ_HT_P(z)->get_method != NULL) {
if (IS_CV == IS_TMP_VAR) {
INIT_PZVAL(z);
}
if (zend_std_cast_object_tostring(z, &z_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
zend_print_variable(&z_copy);
zval_dtor(&z_copy);
} else {
zend_print_variable(z);
}
} else {
zend_print_variable(z);
}