]> granicus.if.org Git - php/commitdiff
Merge branch 'PHP-7.2'
authorDmitry Stogov <dmitry@zend.com>
Thu, 26 Oct 2017 10:35:39 +0000 (13:35 +0300)
committerDmitry Stogov <dmitry@zend.com>
Thu, 26 Oct 2017 10:35:39 +0000 (13:35 +0300)
* PHP-7.2:
  Fixed indirect modification of magic method arguments.

1  2 
Zend/zend_object_handlers.c

index ff8ee732e95216b62753f62d24915d4088724ec0,bb1521a5e002ff46dc8da80a69c9b7e52f0e3efa..0097f45b874c92c26acbcc474befaaf707d43498
@@@ -542,9 -562,9 +542,9 @@@ ZEND_API uint32_t *zend_get_property_gu
  zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv) /* {{{ */
  {
        zend_object *zobj;
-       zval tmp_member;
+       zval tmp_member, tmp_object;
        zval *retval;
 -      uint32_t property_offset;
 +      uintptr_t property_offset;
        uint32_t *guard = NULL;
  
        zobj = Z_OBJ_P(object);
                        } else {
                                retval = &EG(uninitialized_zval);
                        }
+                       zval_ptr_dtor(&tmp_object);
                        goto exit;
                } else {
 -                      zval_ptr_dtor(&tmp_object);
                        if (Z_STRVAL_P(member)[0] == '\0' && Z_STRLEN_P(member) != 0) {
++                              zval_ptr_dtor(&tmp_object);
                                zend_throw_error(NULL, "Cannot access property started with '\\0'");
                                retval = &EG(uninitialized_zval);
                                goto exit;