Fixed segfult in JIT (emalloc may trigger memory limitation)

Zend/tests/bug68412.phpt

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 2ee71084e9dd02b0584272594bcc9dedce78ef02..db1c3710c5c5ece8d13f5e20230fc2d87e6563fa 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -7783,6 +7783,8 @@ ZEND_VM_HANDLER(158, ZEND_CALL_TRAMPOLINE, ANY, ANY)
        zend_execute_data *call;
        USE_OPLINE
 
+       SAVE_OPLINE();
+
        args = emalloc(sizeof(zend_array));
        zend_hash_init(args, num_args, NULL, ZVAL_PTR_DTOR, 0);
        if (num_args) {
@@ -7798,7 +7800,6 @@ ZEND_VM_HANDLER(158, ZEND_CALL_TRAMPOLINE, ANY, ANY)
                } ZEND_HASH_FILL_END();
        }
 
-       SAVE_OPLINE();
        call = execute_data;
        execute_data = EG(current_execute_data) = EX(prev_execute_data);
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index c7c28e78f79ff2f85712773cfc5d77a7dc704ab5..dd2a612fb89898183b81ba411780637b984564c6 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1906,6 +1906,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CALL_TRAMPOLINE_SPEC_HANDLER(Z
        zend_execute_data *call;
        USE_OPLINE
 
+       SAVE_OPLINE();
+
        args = emalloc(sizeof(zend_array));
        zend_hash_init(args, num_args, NULL, ZVAL_PTR_DTOR, 0);
        if (num_args) {
@@ -1921,7 +1923,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CALL_TRAMPOLINE_SPEC_HANDLER(Z
                } ZEND_HASH_FILL_END();
        }
 
-       SAVE_OPLINE();
        call = execute_data;
        execute_data = EG(current_execute_data) = EX(prev_execute_data);