Fixed bug #70156 (Segfault in zend_find_alias_name)

diff --git a/NEWS b/NEWS
index 3d41ca9e7a423950e36506c8b3b30ce15d92e05f..3d41dd90868f7f23d16871e8c1da7e15bae81ce4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,7 +3,7 @@ PHP                                                                        NEWS
 06 Aug 2015, PHP 7.0.0 Beta 3
 
 - Core:
-  . Fixed bug #36365 (scandir duplicates file name at every 65535th file). (cmb)
+  . Fixed bug #70156 (Segfault in zend_find_alias_name). (Laruence)
   . Fixed bug #70124 (null ptr deref / seg fault in ZEND_HANDLE_EXCEPTION).
     (Laruence)
   . Fixed bug #70117 (Unexpected return type error). (Laruence)
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #70140 (str_ireplace/php_string_tolower - Arbitrary Code
     Execution). (Laruence)
+  . Fixed bug #36365 (scandir duplicates file name at every 65535th file). (cmb)
 
 23 Jul 2015, PHP 7.0.0 Beta 2
 

diff --git a/Zend/tests/bug70156.phpt b/Zend/tests/bug70156.phpt
new file mode 100644 (file)
index 0000000..6b5e383
--- /dev/null
+++ b/Zend/tests/bug70156.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Bug #70156 (Segfault in zend_find_alias_name)
+--FILE--
+<?php
+trait T1 {
+       protected function foo1()
+       {
+               $this->bar();
+       }
+}
+
+trait T2 {
+       protected function foo2()
+       {
+               debug_print_backtrace();
+       }
+}
+
+class dummy {
+       use T1 {
+               foo1 as private;
+       }
+       use T2 {
+               foo2 as bar;
+       }
+       public function __construct()
+       {
+               $this->foo1();
+       }
+}
+
+new dummy();
+?>
+--EXPECTF--
+#0  dummy->bar() called at [%sbug70156.php:%d]
+#1  dummy->foo1() called at [%sbug70156.php:%d]
+#2  dummy->__construct() called at [%sbug70156.php:%d]

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index d8e560c844a927481c3477c9cb67896c6c8c0962..4a29c9e117f530df0124af8dd3017870207357e0 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -4106,8 +4106,7 @@ ZEND_API zend_string* zend_find_alias_name(zend_class_entry *ce, zend_string *na
        if ((alias_ptr = ce->trait_aliases)) {
                alias = *alias_ptr;
                while (alias) {
-                       if (ZSTR_LEN(alias->alias) == ZSTR_LEN(name) &&
-                               !strncasecmp(ZSTR_VAL(name), ZSTR_VAL(alias->alias), ZSTR_LEN(alias->alias))) {
+                       if (alias->alias && zend_string_equals_ci(alias->alias, name)) {
                                return alias->alias;
                        }
                        alias_ptr++;