Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER())

diff --git a/NEWS b/NEWS
index eddf0bcdf29d2c38f4a12fb6ca89bba89039fb96..12e2e8f8f2ccd2c05bdf5195cf00310baa9434eb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2017 PHP 7.0.20
 
+- Core:
+  . Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
+    (Laruence)
+
 - intl:
   . Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys). (villfa)
 

diff --git a/Zend/tests/bug74546.phpt b/Zend/tests/bug74546.phpt
new file mode 100644 (file)
index 0000000..9c1582a
--- /dev/null
+++ b/Zend/tests/bug74546.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER())
+--FILE--
+<?php 
+"000000"[0]::d;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Class '0' not found in %sbug74546.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug74546.php on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 9e0621d7837252954254d89deae87a5fd9ca3931..7fe8815e8116e1d2ccf209fd115ada4234aefe50 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -6669,8 +6669,11 @@ void zend_compile_class_const(znode *result, zend_ast *ast) /* {{{ */
                return;
        }
 
-       zend_eval_const_expr(&class_ast);
-       zend_eval_const_expr(&const_ast);
+       zend_eval_const_expr(&ast->child[0]);
+       zend_eval_const_expr(&ast->child[1]);
+
+       class_ast = ast->child[0];
+       const_ast = ast->child[1];
 
        if (class_ast->kind == ZEND_AST_ZVAL) {
                resolved_name = zend_resolve_class_name_ast(class_ast);