Fixed bug #34873 (Segmentation Fault on foreach in object)

diff --git a/Zend/tests/bug34873.phpt b/Zend/tests/bug34873.phpt
index d8683c991f1458818be20abba9875eec294746de..ac7eb209e536bc9ab2bb5df2c0fa59b9452a1491 100644 (file)
--- a/Zend/tests/bug34873.phpt
+++ b/Zend/tests/bug34873.phpt
@@ -25,3 +25,6 @@ echo "Done\n";
 --EXPECT--     
 string(7) "myvalue"
 Done
+--UEXPECT--
+unicode(7) "myvalue"
+Done

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index fdda529d5a3c0417161f5478b6b1468fc1e7913c..66082ba84bcb99f506f76d286adedfe5d97d2d55 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3792,6 +3792,8 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z
        }
 
        value_node = opline->result;
+       
+       zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
        if (assign_by_ref) {
                /* Mark FE_FETCH as IS_VAR as it holds the data directly as a value */
                zend_do_assign_ref(NULL, value, &value_node TSRMLS_CC);
@@ -3803,6 +3805,7 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z
        if (key->op_type != IS_UNUSED) {
                znode key_node;
 
+               zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
                opline = &CG(active_op_array)->opcodes[as_token->u.opline_num+1];
                opline->result.op_type = IS_TMP_VAR;
                opline->result.u.EA.type = 0;

diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index eb76c5ea1983d721c13e89c5692ae6dbf93d30d5..a996378133c7a59a0f4d8af2c92e747c450b2d56 100644 (file)
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -222,7 +222,7 @@ unticked_statement:
                foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
        |       T_FOREACH '(' expr_without_variable { zend_do_foreach_begin(&$1, &$2, &$3, 0 TSRMLS_CC); } T_AS 
                { zend_do_foreach_fetch(&$1, &$2, &$5 TSRMLS_CC); } 
-               w_variable foreach_optional_arg ')' { zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); } 
+               variable foreach_optional_arg ')' { zend_check_writable_variable(&$7); zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); } 
                foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
        |       T_DECLARE { $1.u.opline_num = get_next_op_number(CG(active_op_array)); zend_do_declare_begin(TSRMLS_C); } '(' declare_list ')' declare_statement { zend_do_declare_end(&$1 TSRMLS_CC); }
        |       ';'             /* empty statement */
@@ -340,8 +340,8 @@ foreach_optional_arg:
 
 
 foreach_variable:
-               w_variable                      { $$ = $1; }
-       |       '&' w_variable          { $$ = $2;  $$.u.EA.type |= ZEND_PARSED_REFERENCE_VARIABLE; }
+               variable                        { zend_check_writable_variable(&$1); $$ = $1; }
+       |       '&' variable            { zend_check_writable_variable(&$2); $$ = $2;  $$.u.EA.type |= ZEND_PARSED_REFERENCE_VARIABLE; }
 ;
 
 for_statement: