Fix two possible crashes. Latter is unlikely unless you are doing scary

things, but former looks nasty.

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 734baf522a092e0b6653754da833ac7c7ba19612..80a78afcacb3ea5acb681e255b4ed07f8b48e5a3 100644 (file)
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -671,9 +671,10 @@ ZEND_FUNCTION(get_class_vars)
        if (zend_lookup_class(Z_STRVAL_PP(class_name), Z_STRLEN_PP(class_name), &pce TSRMLS_CC) == FAILURE) {
                RETURN_FALSE;
        } else {
-               int count = zend_hash_num_elements(&ce->default_properties);
+               int count;
 
                ce = *pce;
+               count = zend_hash_num_elements(&ce->default_properties);
                array_init(return_value);
 
                if (count > 0) {
@@ -1680,6 +1681,11 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last TSRML
                        /* i know this is kinda ugly, but i'm trying to avoid extra cycles in the main execution loop */
                        zend_bool build_filename_arg = 1;
 
+                       if (!ptr->opline) {
+                               /* can happen when calling eval from a custom sapi */
+                               function_name = "unknown";
+                               build_filename_arg = 0;
+                       } else
                        switch (ptr->opline->op2.u.constant.value.lval) {
                                case ZEND_EVAL:
                                        function_name = "eval";