Fixed SIGSEGV

diff --git a/Zend/tests/unset_cv12.phpt b/Zend/tests/unset_cv12.phpt
new file mode 100755 (executable)
index 0000000..a22b13d
--- /dev/null
+++ b/Zend/tests/unset_cv12.phpt
@@ -0,0 +1,11 @@
+--TEST--
+unset() CV 12 (unset() in indirect called function)
+--FILE--
+<?php
+$x = 1;
+function foo() {unset($GLOBALS["x"]);}
+call_user_func("foo");
+echo "ok\n";
+?>
+--EXPECT--
+ok

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index c745e6579837c6c905f97020ea36f64fafe6b85f..dc75f94714bbca877ee9fd9cf0cd8fb0d21ee68e 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -1436,7 +1436,7 @@ ZEND_API void zend_reset_all_cv(HashTable *symbol_table TSRMLS_DC)
        int i;
 
        for (ex = EG(current_execute_data); ex; ex = ex->prev_execute_data) {
-               if (ex->symbol_table == symbol_table) {
+               if (ex->op_array && ex->symbol_table == symbol_table) {
                        for (i = 0; i < ex->op_array->last_var; i++) {
                                ex->CVs[i] = NULL;
                        }
@@ -1451,7 +1451,7 @@ ZEND_API int zend_delete_global_variable(char *name, int name_len TSRMLS_DC)
 
        if (zend_hash_quick_exists(&EG(symbol_table), name, name_len+1, hash_value)) {
                for (ex = EG(current_execute_data); ex; ex = ex->prev_execute_data) {
-                       if (ex->symbol_table == &EG(symbol_table)) {
+                       if (ex->op_array && ex->symbol_table == &EG(symbol_table)) {
                                int i;
                                for (i = 0; i < ex->op_array->last_var; i++) {
                                        if (ex->op_array->vars[i].hash_value == hash_value &&

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 5ac7c59464080706c01edfd7dd4871d83f4ee5e3..3d444dc7afd490c1bcb94cbbe02278ec53567396 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2813,12 +2813,14 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMP|VAR|CV, ANY)
                        do {
                                int i;
 
-                               for (i = 0; i < ex->op_array->last_var; i++) {
-                                       if (ex->op_array->vars[i].hash_value == hash_value &&
-                                               ex->op_array->vars[i].name_len == varname->value.str.len &&
-                                               !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
-                                               ex->CVs[i] = NULL;
-                                               break;
+                               if (ex->op_array) {
+                                       for (i = 0; i < ex->op_array->last_var; i++) {
+                                               if (ex->op_array->vars[i].hash_value == hash_value &&
+                                                       ex->op_array->vars[i].name_len == varname->value.str.len &&
+                                                       !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
+                                                       ex->CVs[i] = NULL;
+                                                       break;
+                                               }
                                        }
                                }
                  ex = ex->prev_execute_data;
@@ -2869,7 +2871,7 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = EXECUTE_DATA; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 06ed99034813ca25d380c82968147c906d98ce5a..ea4c13e29381371b792f5decfa16ec3f46838978 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1987,12 +1987,14 @@ static int ZEND_UNSET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        do {
                                int i;
 
-                               for (i = 0; i < ex->op_array->last_var; i++) {
-                                       if (ex->op_array->vars[i].hash_value == hash_value &&
-                                               ex->op_array->vars[i].name_len == varname->value.str.len &&
-                                               !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
-                                               ex->CVs[i] = NULL;
-                                               break;
+                               if (ex->op_array) {
+                                       for (i = 0; i < ex->op_array->last_var; i++) {
+                                               if (ex->op_array->vars[i].hash_value == hash_value &&
+                                                       ex->op_array->vars[i].name_len == varname->value.str.len &&
+                                                       !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
+                                                       ex->CVs[i] = NULL;
+                                                       break;
+                                               }
                                        }
                                }
                  ex = ex->prev_execute_data;
@@ -4404,12 +4406,14 @@ static int ZEND_UNSET_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        do {
                                int i;
 
-                               for (i = 0; i < ex->op_array->last_var; i++) {
-                                       if (ex->op_array->vars[i].hash_value == hash_value &&
-                                               ex->op_array->vars[i].name_len == varname->value.str.len &&
-                                               !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
-                                               ex->CVs[i] = NULL;
-                                               break;
+                               if (ex->op_array) {
+                                       for (i = 0; i < ex->op_array->last_var; i++) {
+                                               if (ex->op_array->vars[i].hash_value == hash_value &&
+                                                       ex->op_array->vars[i].name_len == varname->value.str.len &&
+                                                       !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
+                                                       ex->CVs[i] = NULL;
+                                                       break;
+                                               }
                                        }
                                }
                  ex = ex->prev_execute_data;
@@ -7402,12 +7406,14 @@ static int ZEND_UNSET_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        do {
                                int i;
 
-                               for (i = 0; i < ex->op_array->last_var; i++) {
-                                       if (ex->op_array->vars[i].hash_value == hash_value &&
-                                               ex->op_array->vars[i].name_len == varname->value.str.len &&
-                                               !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
-                                               ex->CVs[i] = NULL;
-                                               break;
+                               if (ex->op_array) {
+                                       for (i = 0; i < ex->op_array->last_var; i++) {
+                                               if (ex->op_array->vars[i].hash_value == hash_value &&
+                                                       ex->op_array->vars[i].name_len == varname->value.str.len &&
+                                                       !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
+                                                       ex->CVs[i] = NULL;
+                                                       break;
+                                               }
                                        }
                                }
                  ex = ex->prev_execute_data;
@@ -8991,7 +8997,7 @@ static int ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -10418,7 +10424,7 @@ static int ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -11883,7 +11889,7 @@ static int ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -13750,7 +13756,7 @@ static int ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -14904,7 +14910,7 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -15942,7 +15948,7 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -16980,7 +16986,7 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -18381,7 +18387,7 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -19502,12 +19508,14 @@ static int ZEND_UNSET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        do {
                                int i;
 
-                               for (i = 0; i < ex->op_array->last_var; i++) {
-                                       if (ex->op_array->vars[i].hash_value == hash_value &&
-                                               ex->op_array->vars[i].name_len == varname->value.str.len &&
-                                               !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
-                                               ex->CVs[i] = NULL;
-                                               break;
+                               if (ex->op_array) {
+                                       for (i = 0; i < ex->op_array->last_var; i++) {
+                                               if (ex->op_array->vars[i].hash_value == hash_value &&
+                                                       ex->op_array->vars[i].name_len == varname->value.str.len &&
+                                                       !memcmp(ex->op_array->vars[i].name, varname->value.str.val, varname->value.str.len)) {
+                                                       ex->CVs[i] = NULL;
+                                                       break;
+                                               }
                                        }
                                }
                  ex = ex->prev_execute_data;
@@ -20943,7 +20951,7 @@ static int ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -22362,7 +22370,7 @@ static int ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -23818,7 +23826,7 @@ static int ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {
@@ -25675,7 +25683,7 @@ static int ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                        ulong hash_value = zend_inline_hash_func(offset->value.str.val, offset->value.str.len+1);
 
                                                        for (ex = execute_data; ex; ex = ex->prev_execute_data) {
-                                                               if (ex->symbol_table == ht) {
+                                                               if (ex->op_array && ex->symbol_table == ht) {
                                                                        int i;
 
                                                                        for (i = 0; i < ex->op_array->last_var; i++) {