Fixed bug #36303 (foreach on error_zval produces segfault)

diff --git a/NEWS b/NEWS
index bdabf8cdf76af39f72c6facbd7f461ba65c8a27c..19dc2d88e1a9ef3604aebc1f14304f5c86242ab2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
 - Added imap_savebody() that allows message body to be written to a file. (Mike)
 - Fixed imagecolorallocate() and imagecolorallocatelapha() to return FALSE
   on error. (Pierre)
+- Fixed bug #36303 (foreach on error_zval produces segfault). (Dmitry)
 - Fixed bug #36295 (typo in SplFileObject::flock() parameter name). (Tony)
 - Fixed bug #36287 (Segfault with SplFileInfo conversion). (Marcus)
 - Fixed bug #36283 (SOAPClient Compression Broken). (Dmitry)

diff --git a/Zend/tests/bug36303.phpt b/Zend/tests/bug36303.phpt
new file mode 100755 (executable)
index 0000000..612022a
--- /dev/null
+++ b/Zend/tests/bug36303.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #36303 (foreach on error_zval produces segfault)
+--FILE--
+<?php
+$x="test";
+foreach($x->a->b as &$v) {
+}
+echo "ok\n";
+?>
+--EXPECTF--
+Warning: Invalid argument supplied for foreach() in %sbug36303.php on line 3
+ok

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index d26e516d5fdec511db015114e63fdf1212095326..97d705bc12bf6777037791546123109e2c6a8355 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2983,7 +2983,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
                        }
                        array_ptr = *array_ptr_ptr;
                } else {
-                       SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
+                               SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
                }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index ef58b0d495301d0e94537fd2dd4171694ef618e2..1a2f2c76c93899ca636867ee5be8353b4ed70daa 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2030,7 +2030,9 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        }
                        array_ptr = *array_ptr_ptr;
                } else {
-                       SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
+                               SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
                }
@@ -4446,7 +4448,9 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        }
                        array_ptr = *array_ptr_ptr;
                } else {
-                       SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
+                               SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
                }
@@ -7444,7 +7448,9 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        }
                        array_ptr = *array_ptr_ptr;
                } else {
-                       SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
+                               SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
                }
@@ -19539,7 +19545,9 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        }
                        array_ptr = *array_ptr_ptr;
                } else {
-                       SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
+                               SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                       }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
                }