Fixed bug #33116 (crash when assigning class name to global variable in __autoload).

diff --git a/Zend/tests/bug33116.phpt b/Zend/tests/bug33116.phpt
new file mode 100755 (executable)
index 0000000..aa714a1
--- /dev/null
+++ b/Zend/tests/bug33116.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #33116 (crash when assigning class name to global variable in __autoload)
+--FILE--
+<?php
+function __autoload($class)
+{
+  $GLOBALS['include'][] = $class;
+  eval("class DefClass{}");
+}
+
+$a = new DefClass;
+print_r($a);
+print_r($GLOBALS['include']);
+?>
+--EXPECT--
+DefClass Object
+(
+)
+Array
+(
+    [0] => DefClass
+)

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 9852180151d7cf42e36651194cab6d462f5eb505..0bfb3ff18a97dca0980e65eee1ac9aa615c5af6d 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -895,7 +895,7 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
 {
        zval **args[1];
        zval autoload_function;
-       zval class_name, *class_name_ptr = &class_name;
+       zval *class_name_ptr;
        zval *retval_ptr;
        int retval;
        char *lc_name;
@@ -936,8 +936,9 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
 
        ZVAL_STRINGL(&autoload_function, ZEND_AUTOLOAD_FUNC_NAME, sizeof(ZEND_AUTOLOAD_FUNC_NAME)-1,  0);
 
+       ALLOC_ZVAL(class_name_ptr);
        INIT_PZVAL(class_name_ptr);
-       ZVAL_STRINGL(class_name_ptr, name, name_length, 0);
+       ZVAL_STRINGL(class_name_ptr, name, name_length, 1);
        
        args[0] = &class_name_ptr;
        
@@ -961,6 +962,8 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
        retval = zend_call_function(&fcall_info, &fcall_cache TSRMLS_CC);
        EG(autoload_func) = fcall_cache.function_handler;
 
+       zval_ptr_dtor(&class_name_ptr);
+
        zend_hash_del(EG(in_autoload), lc_name, name_length+1);
 
        if (retval == FAILURE) {