MFH: Fix aliasing issue (fixes #48409 , #48428 , #48228)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index b4ee7be7cbbfe50683d0a39b302b7c5ce971b4c1..182e6498546832e9cdf0bf4a59c04aaa47436f78 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2288,7 +2288,9 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
                EG(called_scope) = EX(called_scope);
        }
 
-       zend_ptr_stack_3_pop(&EG(arg_types_stack), (void*)&EX(called_scope), (void**)&EX(current_object), (void**)&EX(fbc));
+       EX(called_scope) = zend_ptr_stack_pop(&EG(arg_types_stack));
+       EX(current_object) = zend_ptr_stack_pop(&EG(arg_types_stack));
+       EX(fbc) = zend_ptr_stack_pop(&EG(arg_types_stack));
        EX(function_state).arguments = zend_vm_stack_push_args(opline->extended_value TSRMLS_CC);
 
        if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION) {
@@ -4296,7 +4298,8 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
                        zval_ptr_dtor(&EX(object));
                }
                EX(called_scope) = DECODE_CTOR(EX(called_scope));
-               zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
+               EX(object) = zend_ptr_stack_pop(&EG(arg_types_stack));
+               EX(fbc) = zend_ptr_stack_pop(&EG(arg_types_stack));
        }
 
        for (i=0; i<EX(op_array)->last_brk_cont; i++) {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index bf3419ffc1121727f73ebb70a6c3e763f6251791..b69e681c083968bc86edbaf1c0fca98fbf9ce923 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -290,7 +290,9 @@ static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_AR
                EG(called_scope) = EX(called_scope);
        }
 
-       zend_ptr_stack_3_pop(&EG(arg_types_stack), (void*)&EX(called_scope), (void**)&EX(current_object), (void**)&EX(fbc));
+       EX(called_scope) = zend_ptr_stack_pop(&EG(arg_types_stack));
+       EX(current_object) = zend_ptr_stack_pop(&EG(arg_types_stack));
+       EX(fbc) = zend_ptr_stack_pop(&EG(arg_types_stack));
        EX(function_state).arguments = zend_vm_stack_push_args(opline->extended_value TSRMLS_CC);
 
        if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION) {
@@ -636,7 +638,8 @@ static int ZEND_FASTCALL  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER
                        zval_ptr_dtor(&EX(object));
                }
                EX(called_scope) = DECODE_CTOR(EX(called_scope));
-               zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
+               EX(object) = zend_ptr_stack_pop(&EG(arg_types_stack));
+               EX(fbc) = zend_ptr_stack_pop(&EG(arg_types_stack));
        }
 
        for (i=0; i<EX(op_array)->last_brk_cont; i++) {