Fixed bug #38211 (variable name and cookie name match breaks script execution)

diff --git a/Zend/tests/bug38211.phpt b/Zend/tests/bug38211.phpt
new file mode 100755 (executable)
index 0000000..6ae9430
--- /dev/null
+++ b/Zend/tests/bug38211.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #38211 (variable name and cookie name match breaks script execution)
+--FILE--
+<?php
+$test = 'test';
+unset($$test);
+echo "ok\n";
+?>
+--EXPECT--
+ok

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 2b10e96e15f19343ca639d6e5e1d6f5f4641f30d..91f0987efe8161a399c980f3f7e6e727bfc541f7 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2939,6 +2939,8 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMP|VAR|CV, ANY)
                zval_copy_ctor(&tmp);
                convert_to_text(&tmp);
                varname = &tmp;
+       } else if (OP1_TYPE == IS_CV || OP1_TYPE == IS_VAR) {
+               varname->refcount++;
        }
 
        if (opline->op2.u.EA.type == ZEND_FETCH_STATIC_MEMBER) {
@@ -2969,6 +2971,8 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMP|VAR|CV, ANY)
 
        if (varname == &tmp) {
                zval_dtor(&tmp);
+       } else if (OP1_TYPE == IS_CV || OP1_TYPE == IS_VAR) {
+               zval_ptr_dtor(&varname);
        }
        FREE_OP1();
        ZEND_VM_NEXT_OPCODE();
@@ -3020,6 +3024,8 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (OP2_TYPE == IS_CV || OP2_TYPE == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -3044,6 +3050,8 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (OP2_TYPE == IS_CV || OP2_TYPE == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index cab7fe759a192c2c92566af453e1c574847f638f..e5c0accef0146a023cb9eea911e25cb6e940916d 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2016,6 +2016,8 @@ static int ZEND_UNSET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zval_copy_ctor(&tmp);
                convert_to_text(&tmp);
                varname = &tmp;
+       } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+               varname->refcount++;
        }
 
        if (opline->op2.u.EA.type == ZEND_FETCH_STATIC_MEMBER) {
@@ -2046,6 +2048,8 @@ static int ZEND_UNSET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
        if (varname == &tmp) {
                zval_dtor(&tmp);
+       } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+               zval_ptr_dtor(&varname);
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -4594,6 +4598,8 @@ static int ZEND_UNSET_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zval_copy_ctor(&tmp);
                convert_to_text(&tmp);
                varname = &tmp;
+       } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+               varname->refcount++;
        }
 
        if (opline->op2.u.EA.type == ZEND_FETCH_STATIC_MEMBER) {
@@ -4624,6 +4630,8 @@ static int ZEND_UNSET_VAR_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
        if (varname == &tmp) {
                zval_dtor(&tmp);
+       } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+               zval_ptr_dtor(&varname);
        }
        zval_dtor(free_op1.var);
        ZEND_VM_NEXT_OPCODE();
@@ -7769,6 +7777,8 @@ static int ZEND_UNSET_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zval_copy_ctor(&tmp);
                convert_to_text(&tmp);
                varname = &tmp;
+       } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+               varname->refcount++;
        }
 
        if (opline->op2.u.EA.type == ZEND_FETCH_STATIC_MEMBER) {
@@ -7799,6 +7809,8 @@ static int ZEND_UNSET_VAR_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
        if (varname == &tmp) {
                zval_dtor(&tmp);
+       } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+               zval_ptr_dtor(&varname);
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9501,6 +9513,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -9525,6 +9539,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -11026,6 +11042,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -11050,6 +11068,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -12589,6 +12609,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -12613,6 +12635,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -14576,6 +14600,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -14600,6 +14626,8 @@ static int ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -15817,6 +15845,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -15841,6 +15871,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -16937,6 +16969,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -16961,6 +16995,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -18057,6 +18093,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -18081,6 +18119,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -19550,6 +19590,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -19574,6 +19616,8 @@ static int ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -20744,6 +20788,8 @@ static int ZEND_UNSET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zval_copy_ctor(&tmp);
                convert_to_text(&tmp);
                varname = &tmp;
+       } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+               varname->refcount++;
        }
 
        if (opline->op2.u.EA.type == ZEND_FETCH_STATIC_MEMBER) {
@@ -20774,6 +20820,8 @@ static int ZEND_UNSET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
        if (varname == &tmp) {
                zval_dtor(&tmp);
+       } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+               zval_ptr_dtor(&varname);
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22320,6 +22368,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -22344,6 +22394,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -23837,6 +23889,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -23861,6 +23915,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -25391,6 +25447,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -25415,6 +25473,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }
@@ -27368,6 +27428,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                                offset_len = norm_len;
                                                                free_offset = 1;
                                                        }
+                                               } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+                                                       offset->refcount++;
                                                }
 
                                                if (zend_u_symtable_del(ht, Z_TYPE_P(offset), offset_key, offset_len+1) == SUCCESS &&
@@ -27392,6 +27454,8 @@ static int ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                                }
                                                if (free_offset) {
                                                        efree(offset_key.v);
+                                               } else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
+                                                       zval_ptr_dtor(&offset);
                                                }
                                                break;
                                        }