Fixed bug #63305 (zend_mm_heap corrupted with traits)

diff --git a/NEWS b/NEWS
index a13f99dd5b1e924cb81e752f749defeaf397d2b3..a0396154a5d291a65d2ceb754889ac19624c9b1d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.4.9
 
+- Core:
+  . Fixed bug #63305 (zend_mm_heap corrupted with traits). (Dmitry, Laruence)
+
 - Fileinfo:
   . Fixed bug #63248 (Load multiple magic files from a directory under Windows).
     (Anatoliy)

diff --git a/Zend/tests/bug63305.phpt b/Zend/tests/bug63305.phpt
new file mode 100644 (file)
index 0000000..4bd3a4d
--- /dev/null
+++ b/Zend/tests/bug63305.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #63305 (zend_mm_heap corrupted with traits)
+--FILE--
+<?php
+new Attachment("");
+
+function __autoload($class) {
+    switch ($class) {
+    case "Attachment":
+        eval(<<<'PHP'
+class Attachment extends File {
+}
+PHP
+    );
+        break;
+    case "File":
+        eval(<<<'PHP'
+class File {
+    use TDatabaseObject {
+        TDatabaseObject::__construct as private databaseObjectConstruct;
+    }
+    public function __construct() {
+    }
+}
+PHP
+    );
+        break;
+    case "TDatabaseObject":
+        eval(<<<'PHP'
+trait TDatabaseObject {
+    public function __construct() {
+    }
+}
+PHP
+    );
+        break;
+    }
+    return TRUE;
+}
+echo "okey";
+?>
+--EXPECT--
+okey

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 303eedb6bc10f04b69b5e2180c5a38750313aa34..4dd3eaf1ed2e1b7e629260a5f794aa4c1849294a 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3885,7 +3885,7 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
                                        
                                /* if it is 0, no modifieres has been changed */
                                if (aliases[i]->modifiers) { 
-                                       fn_copy.common.fn_flags = aliases[i]->modifiers;
+                                       fn_copy.common.fn_flags = aliases[i]->modifiers | ZEND_ACC_ALIAS;
                                        if (!(aliases[i]->modifiers & ZEND_ACC_PPP_MASK)) {
                                                fn_copy.common.fn_flags |= ZEND_ACC_PUBLIC;
                                        }
@@ -3926,7 +3926,7 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
                                        && (!aliases[i]->trait_method->ce || fn->common.scope == aliases[i]->trait_method->ce)
                                        && (aliases[i]->trait_method->mname_len == fnname_len)
                                        && (zend_binary_strcasecmp(aliases[i]->trait_method->method_name, aliases[i]->trait_method->mname_len, fn->common.function_name, fnname_len) == 0)) {
-                                       fn_copy.common.fn_flags = aliases[i]->modifiers;
+                                       fn_copy.common.fn_flags = aliases[i]->modifiers | ZEND_ACC_ALIAS;
 
                                        if (!(aliases[i]->modifiers & ZEND_ACC_PPP_MASK)) {
                                                fn_copy.common.fn_flags |= ZEND_ACC_PUBLIC;