- Fix problem with assigning functions by reference.

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index abefc3ce1d8ea77f0f8a8e5685335d7973f05c96..5e85195630f248661f9f0ac742e4d47d98540056 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1552,8 +1552,18 @@ binary_assign_op_addr_obj:
                                }
                                NEXT_OPCODE();
                        case ZEND_ASSIGN_REF:
-                               zend_assign_to_variable_reference(&EX(opline)->result, get_zval_ptr_ptr(&EX(opline)->op1, EX(Ts), BP_VAR_W), get_zval_ptr_ptr(&EX(opline)->op2, EX(Ts), BP_VAR_W), EX(Ts) TSRMLS_CC);
-                               NEXT_OPCODE();
+                               {
+                                       zval **value_ptr_ptr = get_zval_ptr_ptr(&EX(opline)->op2, EX(Ts), BP_VAR_W);
+
+                                       if (value_ptr_ptr = &EX(Ts)[EX(opline)->op2.u.var].var.ptr) {
+                                               if (!(*value_ptr_ptr != &EG(uninitialized_zval) && (PZVAL_IS_REF(*value_ptr_ptr) || (*value_ptr_ptr)->refcount == 1)))
+                                               {
+                                                       zend_error(E_ERROR, "Can't assign by reference non-referencable value!");
+                                               }
+                                       }
+                                       zend_assign_to_variable_reference(&EX(opline)->result, get_zval_ptr_ptr(&EX(opline)->op1, EX(Ts), BP_VAR_W), value_ptr_ptr, EX(Ts) TSRMLS_CC);
+                                       NEXT_OPCODE();
+                               }
                        case ZEND_JMP:
 #if DEBUG_ZEND>=2
                                printf("Jumping to %d\n", EX(opline)->op1.u.opline_num);

diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index 17cd896db3e332a39986912f1062494e677528e8..a6a6fc7a83dee97b2566c8bffaf269609e0d6e34 100644 (file)
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -173,7 +173,6 @@ statement:
                unticked_statement { zend_do_ticks(TSRMLS_C); }
 ;
 
-
 unticked_statement:
                '{' inner_statement_list '}'
        |       T_IF '(' expr ')' { zend_do_if_cond(&$3, &$4 TSRMLS_CC); } statement { zend_do_if_after_statement(&$4, 1 TSRMLS_CC); } elseif_list else_single { zend_do_if_end(TSRMLS_C); }
@@ -478,7 +477,7 @@ non_empty_for_expr:
 expr_without_variable: 
                T_LIST '(' { zend_do_list_init(TSRMLS_C); } assignment_list ')' '=' expr { zend_do_list_end(&$$, &$7 TSRMLS_CC); }
        |       variable '=' expr               { zend_check_writable_variable(&$$); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_assign(&$$, &$1, &$3 TSRMLS_CC); }
-       |       variable '=' '&' w_variable     { zend_check_writable_variable(&$$); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_assign_ref(&$$, &$1, &$4 TSRMLS_CC); }
+       |       variable '=' '&' variable { zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_assign_ref(&$$, &$1, &$4 TSRMLS_CC); }
        |       variable '=' '&' T_NEW new_class_entry { zend_check_writable_variable(&$$); zend_do_extended_fcall_begin(TSRMLS_C); zend_do_begin_new_object(&$4, &$5 TSRMLS_CC); } ctor_arguments { zend_do_end_new_object(&$3, &$4, &$7 TSRMLS_CC); zend_do_extended_fcall_end(TSRMLS_C); zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC); zend_do_assign_ref(&$$, &$1, &$3 TSRMLS_CC); }
        |       T_NEW new_class_entry { zend_do_extended_fcall_begin(TSRMLS_C); zend_do_begin_new_object(&$1, &$2 TSRMLS_CC); } ctor_arguments { zend_do_end_new_object(&$$, &$1, &$4 TSRMLS_CC); zend_do_extended_fcall_end(TSRMLS_C);}
        |       variable T_PLUS_EQUAL expr      { zend_check_writable_variable(&$$); zend_do_end_variable_parse(BP_VAR_RW, 0 TSRMLS_CC); zend_do_binary_assign_op(ZEND_ASSIGN_ADD, &$$, &$1, &$3 TSRMLS_CC); }