Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).

diff --git a/NEWS b/NEWS
index f1cc520650ba2940ae55f27a40593f079740a0af..37520dc7d30e759fe829767ca8662c8f88b149db 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2017 PHP 7.0.25
 
 - Core:
+  . Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).
+    (Laruence)
   . Fixed bug #75236 (infinite loop when printing an error-message). (Andrea)
   . Fixed bug #75252 (Incorrect token formatting on two parse errors in one
     request). (Nikita)

diff --git a/Zend/tests/bug75241.phpt b/Zend/tests/bug75241.phpt
new file mode 100644 (file)
index 0000000..1751bbe
--- /dev/null
+++ b/Zend/tests/bug75241.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #75241 (Null pointer dereference in zend_mm_alloc_small())
+--FILE--
+<?php
+function eh(){}
+
+set_error_handler('eh');
+
+$d->d = &$d + $d->d/=0;
+var_dump($d);
+?>
+--EXPECT--
+float(INF)

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 3a8929b83f9ffef543890ffc426f903acbf2740b..d87dba919b73b7ae3ef3023543f97b157e3a2fd3 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -221,8 +221,10 @@ try_again:
                                        if (Z_TYPE(holder) == IS_LONG) {                                \
                                                if (op == result) {                                                     \
                                                        zval_ptr_dtor(op);                                              \
+                                                       ZVAL_LONG(op, Z_LVAL(holder));                  \
+                                               } else {                                                                        \
+                                                       (op) = &(holder);                                               \
                                                }                                                                                       \
-                                               (op) = &(holder);                                                       \
                                        }                                                                                               \
                                        break;                                                                                  \
                        }                                                                                                               \