Fixed bug #34310 (foreach($arr as $c->d => $x) crashes)

diff --git a/NEWS b/NEWS
index 66e0166e03e8115e9e07fe7599ada17f1775d3f2..8617be6bfcbe1dec689df65eed42e687fae05334 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,7 @@ PHP                                                                        NEWS
 - Fixed "make test" to work for phpized extensions. (Hartmut, Jani)
 - Fixed failing queries (FALSE returned) with mysqli_query() on 64 bit systems.
   (Andrey)
+- Fixed bug #34310 (foreach($arr as $c->d => $x) crashes). (Dmitry)
 - Fixed bug #34306 (wddx_serialize_value() crashes with long array keys). (Jani)
 - Fixed bug #34302 (date('W') do not return leading zeros for week 1 to 9).
   (Derick)

diff --git a/Zend/tests/bug34310.phpt b/Zend/tests/bug34310.phpt
index 2f7c477149f865a94ec0e38fe6e34e6d067b4613..1d2bb03ad3e5088f15ed6391969fb7b7c2222891 100644 (file)
--- a/Zend/tests/bug34310.phpt
+++ b/Zend/tests/bug34310.phpt
@@ -5,7 +5,7 @@ Bug #34310 (foreach($arr as $c->d => $x) crashes)
 
 class C
 {
-       var $d;
+       public $d;
 }
 
 $c = new C();

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index ec1df4b844964e26538c1d51809c7af2dd2ada2a..c1a4f586dd00e6adf89c6f8a8d64ae8d5a8724a8 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -543,14 +543,20 @@ void zend_do_assign(znode *result, znode *variable, znode *value TSRMLS_DC)
        if (last_op_number > 0) {
                zend_op *last_op = &CG(active_op_array)->opcodes[last_op_number-1];
 
-               if (last_op->opcode == ZEND_FETCH_OBJ_W) {
+               if (variable->op_type == IS_VAR &&
+                   last_op->opcode == ZEND_FETCH_OBJ_W &&
+                   last_op->result.op_type == IS_VAR &&
+                   last_op->result.u.var == variable->u.var) {
                        last_op->opcode = ZEND_ASSIGN_OBJ;
 
                        zend_do_op_data(opline, value TSRMLS_CC);
                        SET_UNUSED(opline->result);
                        *result = last_op->result;
                        return;
-               } else if (last_op->opcode == ZEND_FETCH_DIM_W) {
+               } else if (variable->op_type == IS_VAR &&
+                          last_op->opcode == ZEND_FETCH_DIM_W &&
+                          last_op->result.op_type == IS_VAR &&
+                          last_op->result.u.var == variable->u.var) {
                        last_op->opcode = ZEND_ASSIGN_DIM;
 
                        zend_do_op_data(opline, value TSRMLS_CC);