Fixed bug #43851 (Memory corrution on reuse of assigned value)

diff --git a/Zend/tests/bug43851.phpt b/Zend/tests/bug43851.phpt
new file mode 100644 (file)
index 0000000..e19e393
--- /dev/null
+++ b/Zend/tests/bug43851.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #43851 (Memory corrution on reuse of assigned value)
+--FILE--
+<?php
+foo();
+function foo() {
+       global $LAST;
+       ($LAST = $LAST + 0) * 1;
+       echo "ok\n";
+}
+?>
+--EXPECT--
+ok

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index af7a6d1d07f414aba7bf1f6766fcaaa7181756d7..c131edf99ae531c316393bcc6de0bcfa51127f55 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -756,7 +756,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
 
        if (Z_TYPE_P(variable_ptr) == IS_OBJECT && Z_OBJ_HANDLER_P(variable_ptr, set)) {
                Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr_ptr, value TSRMLS_CC);
-               return value;
+               return variable_ptr;
        }
 
        if (PZVAL_IS_REF(variable_ptr)) {
@@ -775,7 +775,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
                                Z_DELREF_P(value);
                        }
                        zendi_zval_dtor(garbage);
-                       return value;
+                       return variable_ptr;
                }
        } else {
                if (Z_DELREF_P(variable_ptr) == 0) {