Fixed bug #60444 (Segmentation fault with include & class extending)

diff --git a/Zend/tests/bug60444.phpt b/Zend/tests/bug60444.phpt
new file mode 100644 (file)
index 0000000..38f81bc
--- /dev/null
+++ b/Zend/tests/bug60444.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #60444 (Segmentation fault with include & class extending)
+--FILE--
+<?php
+class Foo {
+       public function __construct() {
+               eval("class Bar extends Foo {}");
+               Some::foo($this);
+       }
+}
+class Some {
+       public static function foo(Foo $foo) {
+       }
+}
+new Foo;
+echo "done\n";
+--EXPECT--
+done

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 9a4afc05a8338966cb13d6606b3b6480de2362ec..73a5652dc4a80b961da09473124d3c10a16a3d1f 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2809,7 +2809,7 @@ ZEND_API void function_add_ref(zend_function *function) /* {{{ */
 
 static void do_inherit_parent_constructor(zend_class_entry *ce) /* {{{ */
 {
-       zend_function *function;
+       zend_function *function, *new_function;
 
        if (!ce->parent) {
                return;
@@ -2870,8 +2870,8 @@ static void do_inherit_parent_constructor(zend_class_entry *ce) /* {{{ */
 
        if (zend_hash_find(&ce->parent->function_table, ZEND_CONSTRUCTOR_FUNC_NAME, sizeof(ZEND_CONSTRUCTOR_FUNC_NAME), (void **)&function)==SUCCESS) {
                /* inherit parent's constructor */
-               zend_hash_update(&ce->function_table, ZEND_CONSTRUCTOR_FUNC_NAME, sizeof(ZEND_CONSTRUCTOR_FUNC_NAME), function, sizeof(zend_function), NULL);
-               function_add_ref(function);
+               zend_hash_update(&ce->function_table, ZEND_CONSTRUCTOR_FUNC_NAME, sizeof(ZEND_CONSTRUCTOR_FUNC_NAME), function, sizeof(zend_function), (void**)&new_function);
+               function_add_ref(new_function);
        } else {
                /* Don't inherit the old style constructor if we already have the new style constructor */
                char *lc_class_name;
@@ -2884,8 +2884,8 @@ static void do_inherit_parent_constructor(zend_class_entry *ce) /* {{{ */
                                        zend_hash_find(&ce->parent->function_table, lc_parent_class_name, ce->parent->name_length+1, (void **)&function)==SUCCESS) {
                                if (function->common.fn_flags & ZEND_ACC_CTOR) {
                                        /* inherit parent's constructor */
-                                       zend_hash_update(&ce->function_table, lc_parent_class_name, ce->parent->name_length+1, function, sizeof(zend_function), NULL);
-                                       function_add_ref(function);
+                                       zend_hash_update(&ce->function_table, lc_parent_class_name, ce->parent->name_length+1, function, sizeof(zend_function), (void**)new_function);
+                                       function_add_ref(new_function);
                                }
                        }
                        efree(lc_parent_class_name);