Fixed bug #64677 (execution operator `` stealing surrounding arguments)

diff --git a/NEWS b/NEWS
index 969780e9ce0f349cd0ef9c682b09ced3fe4dac91..15aa0bcad7cd41e660a7effc85b8bc2307daf821 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 20??, PHP 5.5.0 Beta 4
 
+- Core:
+  . Fixed bug #64677 (execution operator `` stealing surrounding arguments). 
+    (Laruence)
+
 - Zip:
   . Fixed bug #64342 (ZipArchive::addFile() has to check for file existence).
     (Anatol)

diff --git a/Zend/tests/bug64677.phpt b/Zend/tests/bug64677.phpt
new file mode 100644 (file)
index 0000000..44a7c5f
--- /dev/null
+++ b/Zend/tests/bug64677.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #64677 (execution operator `` stealing surrounding arguments)
+--FILE--
+<?PHP
+class cat {
+       public function show_output($prepend, $output = '') {
+       }
+}
+$cat = new cat();
+$cat->show_output('Files: ', trim(`cd .`)); // this gives invalid args to shell_exec
+$cat->show_output('Files: ', `cd .`); // this causes a segmentation fault
+$cat->show_output(`cd .`); // this causes a segmentation fault
+
+function show_outputa($prepend, $output) {
+       echo "Okey";
+}
+show_outputa('Files: ', `cd .`); // this works as expected
+
+?>
+--EXPECT--
+Okey

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 7680790918348b5f7e7e62e9868187c36441b16c..3c0d753b664970e7d41bea1f744652623018ddfc 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -5702,6 +5702,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC) /* {{{ */
        GET_CACHE_SLOT(opline->op1.constant);
        opline->extended_value = 1;
        SET_UNUSED(opline->op2);
+       opline->op2.num = CG(context).nested_calls;
        GET_NODE(result, opline->result);
 
        if (CG(context).nested_calls + 1 > CG(active_op_array)->nested_calls) {