Fixed Bug #70918 (Segfault using static outside of class scope)

diff --git a/Zend/tests/bug70918.phpt b/Zend/tests/bug70918.phpt
new file mode 100644 (file)
index 0000000..68eaef4
--- /dev/null
+++ b/Zend/tests/bug70918.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #70918 (Segfault using static outside of class scope)
+--FILE--
+<?php
+try {
+       static::x;
+} catch (Error $e) {
+       var_dump($e->getMessage());
+}
+
+try {
+       parent::x;
+} catch (Error $e) {
+       var_dump($e->getMessage());
+}
+
+try {
+       self::x;
+} catch (Error $e) {
+       var_dump($e->getMessage());
+}
+?>
+--EXPECT--
+string(52) "Cannot access static:: when no class scope is active"
+string(52) "Cannot access parent:: when no class scope is active"
+string(50) "Cannot access self:: when no class scope is active"

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 093f9f851e2d3f8878bf8c66206309c08f28dd9c..1096296395ebc6de2ef2eed3f7238ae601207b82 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -5180,6 +5180,10 @@ ZEND_VM_HANDLER(181, ZEND_FETCH_CLASS_CONSTANT, VAR|CONST|UNUSED, CONST)
                } else {
                        if (OP1_TYPE == IS_UNUSED) {
                                ce = zend_fetch_class(NULL, opline->op1.num);
+                               if (UNEXPECTED(ce == NULL)) {
+                                       ZEND_ASSERT(EG(exception));
+                                       HANDLE_EXCEPTION();
+                               }
                        } else {
                                ce = Z_CE_P(EX_VAR(opline->op1.var));
                        }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index a2e63a1a8dddbf9d4f73f48f6c840db9905ba1f6..d78021853928248ad1cf22cee5ffdd029d006c21 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -5841,6 +5841,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_CLASS_CONSTANT_SPEC_CONS
                } else {
                        if (IS_CONST == IS_UNUSED) {
                                ce = zend_fetch_class(NULL, opline->op1.num);
+                               if (UNEXPECTED(ce == NULL)) {
+                                       ZEND_ASSERT(EG(exception));
+                                       HANDLE_EXCEPTION();
+                               }
                        } else {
                                ce = Z_CE_P(EX_VAR(opline->op1.var));
                        }
@@ -17507,6 +17511,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_CLASS_CONSTANT_SPEC_VAR_
                } else {
                        if (IS_VAR == IS_UNUSED) {
                                ce = zend_fetch_class(NULL, opline->op1.num);
+                               if (UNEXPECTED(ce == NULL)) {
+                                       ZEND_ASSERT(EG(exception));
+                                       HANDLE_EXCEPTION();
+                               }
                        } else {
                                ce = Z_CE_P(EX_VAR(opline->op1.var));
                        }
@@ -23906,6 +23914,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_CLASS_CONSTANT_SPEC_UNUS
                } else {
                        if (IS_UNUSED == IS_UNUSED) {
                                ce = zend_fetch_class(NULL, opline->op1.num);
+                               if (UNEXPECTED(ce == NULL)) {
+                                       ZEND_ASSERT(EG(exception));
+                                       HANDLE_EXCEPTION();
+                               }
                        } else {
                                ce = Z_CE_P(EX_VAR(opline->op1.var));
                        }