Fixed bug #34873 (Segmentation Fault on foreach in object)

diff --git a/NEWS b/NEWS
index 025a0148c6fc8dde30a34024779c06b37ab44bdc..54bce65505f257a0c9dc35200f1b16563e7d7ef0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Oct 2005, PHP 5.1 Release Candidate 3
+- Fixed bug #34873 (Segmentation Fault on foreach in object). (Dmitry)
 
 14 Oct 2005, PHP 5.1 Release Candidate 2
 - Changed SQLite extension to be a shared module in Windows distribution.

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 9643e154389383c61a128e11995d0b3cd40a34d5..decfaa7b2451de9eaa0cd8d95804898478eabf5c 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3636,7 +3636,8 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z
        }
 
        value_node = opline->result;
-       if (assign_by_ref) {
+       zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
+       if (assign_by_ref) {
                /* Mark FE_FETCH as IS_VAR as it holds the data directly as a value */
                zend_do_assign_ref(NULL, value, &value_node TSRMLS_CC);
        } else {
@@ -3647,7 +3648,8 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z
        if (key->op_type != IS_UNUSED) {
                znode key_node;
 
-               opline = &CG(active_op_array)->opcodes[as_token->u.opline_num+1];
+               zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
+               opline = &CG(active_op_array)->opcodes[as_token->u.opline_num+1];
                opline->result.op_type = IS_TMP_VAR;
                opline->result.u.EA.type = 0;
                opline->result.u.opline_num = get_temporary_variable(CG(active_op_array));

diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index 20523e4c6787d50a846d0852aa39b2c4debbc266..b1fd03809606a9c5415ff1c48a3c3e5edf5080cc 100644 (file)
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -220,7 +220,7 @@ unticked_statement:
                foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
        |       T_FOREACH '(' expr_without_variable { zend_do_foreach_begin(&$1, &$2, &$3, 0 TSRMLS_CC); } T_AS 
                { zend_do_foreach_fetch(&$1, &$2, &$5 TSRMLS_CC); } 
-               w_variable foreach_optional_arg ')' { zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); } 
+               variable foreach_optional_arg ')' { zend_check_writable_variable(&$7); zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); } 
                foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
        |       T_DECLARE { $1.u.opline_num = get_next_op_number(CG(active_op_array)); zend_do_declare_begin(TSRMLS_C); } '(' declare_list ')' declare_statement { zend_do_declare_end(&$1 TSRMLS_CC); }
        |       ';'             /* empty statement */
@@ -338,8 +338,8 @@ foreach_optional_arg:
 
 
 foreach_variable:
-               w_variable                      { $$ = $1; }
-       |       '&' w_variable          { $$ = $2;  $$.u.EA.type |= ZEND_PARSED_REFERENCE_VARIABLE; }
+               variable                        { zend_check_writable_variable(&$1); $$ = $1; }
+       |       '&' variable            { zend_check_writable_variable(&$2); $$ = $2;  $$.u.EA.type |= ZEND_PARSED_REFERENCE_VARIABLE; }
 ;
 
 for_statement: