Fixed bug #78644

Make sure the initialize the result of FETCH_OBJ_UNSET operations.
I'm using a NULL value rather than ERROR here, because the latter
no longer exists in master.

diff --git a/NEWS b/NEWS
index 8f79383ca56322cfc16b861a0e0c6bc61d1593a5..ff37a024b123dfe1b67df2e702b13dd8ecfffa09 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,8 @@ PHP                                                                        NEWS
   . Fixed bug #78620 (Out of memory error). (cmb, Nikita)
   . Fixed bug #78632 (method_exists() in php74 works differently from php73 in
     checking priv. methods). (Nikita)
+  . Fixed bug #78644 (SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER).
+    (Nikita)
 
 - Iconv:
   . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,

diff --git a/Zend/tests/bug78644.phpt b/Zend/tests/bug78644.phpt
new file mode 100644 (file)
index 0000000..3889e9f
--- /dev/null
+++ b/Zend/tests/bug78644.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #78644: SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER
+--FILE--
+<?php
+
+$a = new stdClass;
+unset($a->b->c->d);
+unset($a->b->c['d']);
+var_dump($a);
+
+?>
+--EXPECT--
+object(stdClass)#1 (1) {
+  ["b"]=>
+  NULL
+}

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 42822785cb70b413ddfa8cb3e2754617ea226b2b..15f3ee792a22848a68c2aeaa2fbceaa8b4bce86e 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2765,6 +2765,7 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 
                        /* this should modify object only if it's empty */
                        if (type == BP_VAR_UNSET) {
+                               ZVAL_NULL(result);
                                return;
                        }