Fixed bug #47165 (Possible memory corruption when passing return value by reference)

diff --git a/Zend/tests/bug47165.phpt b/Zend/tests/bug47165.phpt
new file mode 100644 (file)
index 0000000..343c98c
--- /dev/null
+++ b/Zend/tests/bug47165.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #47165 (Possible memory corruption when passing return value by reference)
+--FILE--
+<?php
+class Foo {
+       var $bar = array();
+
+       static function bar() {
+               static $instance = null;
+               $instance = new Foo();
+               return $instance->bar;
+       }
+}
+extract(Foo::bar());
+echo "ok\n";
+?>
+--EXPECTF--
+
+Strict Standards: Only variables should be passed by reference in %sbug47165.php on line 11
+ok

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 2e002a012a60792d189b025eb6d2b68bac998f2f..e6fc233018a8617523852a7f7f744a0bcae40112 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2213,8 +2213,17 @@ void zend_do_pass_param(znode *param, zend_uchar op, int offset TSRMLS_DC) /* {{
                send_by_reference = 1;
        } else if (function_ptr) {
                if (ARG_MAY_BE_SENT_BY_REF(function_ptr, (zend_uint) offset)) {
-                       op = (param->op_type & (IS_VAR|IS_CV))?ZEND_SEND_REF:ZEND_SEND_VAL;
-                       send_by_reference = 0;
+                       if (param->op_type & (IS_VAR|IS_CV)) {
+                               send_by_reference = 1;
+                               if (op == ZEND_SEND_VAR && zend_is_function_or_method_call(param)) {
+                                       /* Method call */
+                                       op = ZEND_SEND_VAR_NO_REF;
+                                       send_function = ZEND_ARG_SEND_FUNCTION;
+                               }
+                       } else {
+                               op = ZEND_SEND_VAL;
+                               send_by_reference = 0;
+                       }
                } else {
                        send_by_reference = ARG_SHOULD_BE_SENT_BY_REF(function_ptr, (zend_uint) offset) ? ZEND_ARG_SEND_BY_REF : 0;
                }

diff --git a/ext/standard/tests/array/extract_variation9.phpt b/ext/standard/tests/array/extract_variation9.phpt
index 4d42a697624732129b4456dbc59d90106839bf56..e0b3a75fb8a312c0b83adbeab7194055d977bce4 100644 (file)
--- a/ext/standard/tests/array/extract_variation9.phpt
+++ b/ext/standard/tests/array/extract_variation9.phpt
@@ -14,7 +14,9 @@ var_dump ( extract(get_object_vars($A),EXTR_REFS));
 
 echo "Done\n";
 ?>
---EXPECT--
+--EXPECTF--
 *** Testing for object ***
+
+Strict Standards: Only variables should be passed by reference in %sextract_variation9.php on line 10
 int(1)
 Done