Fixed bug #76667 (Segfault with divide-assign op and __get + __set)

diff --git a/NEWS b/NEWS
index 379d0fac28e78a32476d43ff4be7efd12e03623c..21ac878b104d7d0dec2640c4061071c5fa110552 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.0beta1
 
+- Core:
+  . Fixed bug #76667 (Segfault with divide-assign op and __get + __set).
+    (Laruence)
+
 - SQLite3:
   . Fixed #76665 (SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle).
     (cmb)

diff --git a/Zend/tests/bug76667.phpt b/Zend/tests/bug76667.phpt
new file mode 100644 (file)
index 0000000..15dc346
--- /dev/null
+++ b/Zend/tests/bug76667.phpt
@@ -0,0 +1,38 @@
+--TEST--
+Bug #76667 (Segfault with divide-assign op and __get + __set)
+--FILE--
+<?php
+
+class T {
+       public function __get($k)
+       {
+               return $undefined->$k;
+       }
+
+       public function __set($k, $v)
+       {
+               return $this->$v /= 0;
+       }
+};
+
+$x = new T;
+$x->x = 1;
+?>
+--EXPECTF--
+Notice: Undefined variable: undefined in %sbug76667.php on line %d
+
+Notice: Trying to get property '1' of non-object in %sbug76667.php on line %d
+
+Warning: Division by zero in %sbug76667.php on line %d
+
+Notice: Undefined variable: undefined in %sbug76667.php on line %d
+
+Notice: Trying to get property 'NAN' of non-object in %sbug76667.php on line %d
+
+Warning: Division by zero in %sbug76667.php on line %d
+
+Notice: Undefined variable: undefined in %sbug76667.php on line %d
+
+Notice: Trying to get property 'NAN' of non-object in %sbug76667.php on line %d
+
+Warning: Division by zero in %sbug76667.php on line %d

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 6528dc0cb3cdecf5cb57794ceee1baedd855eb12..0abed6a85b49bc994592ab8c485dc9505bc6cc47 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -631,7 +631,7 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_assign
        zend_string *tmp_property_name;
        zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
        zend_error(E_WARNING, "Attempt to assign property '%s' of non-object", ZSTR_VAL(property_name));
-       zend_tmp_string_release(property_name);
+       zend_tmp_string_release(tmp_property_name);
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
                ZVAL_NULL(EX_VAR(opline->result.var));
        }
@@ -659,7 +659,7 @@ static zend_never_inline ZEND_COLD int ZEND_FASTCALL make_real_object(zval *obje
                        } else {
                                zend_error(E_WARNING, "Attempt to assign property '%s' of non-object", ZSTR_VAL(property_name));
                        }
-                       zend_tmp_string_release(property_name);
+                       zend_tmp_string_release(tmp_property_name);
                }
                if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
                        ZVAL_NULL(EX_VAR(opline->result.var));
@@ -693,7 +693,7 @@ static zend_never_inline ZEND_COLD int ZEND_FASTCALL make_real_object_rw(zval *o
                        zend_string *tmp_property_name;
                        zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
                        zend_error(E_WARNING, "Attempt to modify property '%s' of non-object", ZSTR_VAL(property_name));
-                       zend_tmp_string_release(property_name);
+                       zend_tmp_string_release(tmp_property_name);
                }
                return 0;
        }
@@ -1332,7 +1332,7 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_read(z
        zend_string *tmp_property_name;
        zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
        zend_error(E_NOTICE, "Trying to get property '%s' of non-object", ZSTR_VAL(property_name));
-       zend_tmp_string_release(property_name);
+       zend_tmp_string_release(tmp_property_name);
 }
 
 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_unset(zval *property)
@@ -1340,7 +1340,7 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_unset(
        zend_string *tmp_property_name;
        zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
        zend_error(E_NOTICE, "Trying to unset property '%s' of non-object", ZSTR_VAL(property_name));
-       zend_tmp_string_release(property_name);
+       zend_tmp_string_release(tmp_property_name);
 }
 
 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_check(zval *property)
@@ -1348,7 +1348,7 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_check(
        zend_string *tmp_property_name;
        zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
        zend_error(E_NOTICE, "Trying to check property '%s' of non-object", ZSTR_VAL(property_name));
-       zend_tmp_string_release(property_name);
+       zend_tmp_string_release(tmp_property_name);
 }
 
 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_deprecated_function(const zend_function *fbc)