Fixed bug #76025 (Segfault while throwing exception in error_handler).

diff --git a/NEWS b/NEWS
index b5c15891fc2021d3a348c1412ff095fef1a5708f..14a5b29f6a217f2692d0d8e42c45f1d85712bafa 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,11 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? ????, PHP 7.1.16
+
+- Core:
+  . Fixed bug #76025 (Segfault while throwing exception in error_handler).
+    (Dmitry, Laruence)
+
 01 Feb 2018, PHP 7.1.15
 
 - Apache2Handler:

diff --git a/Zend/tests/bug76025.phpt b/Zend/tests/bug76025.phpt
new file mode 100644 (file)
index 0000000..2619984
--- /dev/null
+++ b/Zend/tests/bug76025.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #76025 (Segfault while throwing exception in error_handler)
+--FILE--
+<?php
+
+function handleError($errno, $errstr, $errfile, $errline) {
+       $exception = new exception("blah");
+       throw $exception;
+}
+set_error_handler('handleError', E_ALL);
+$c = $b[$a];
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: blah in %sbug76025.php:%d
+Stack trace:
+#0 %sbug76025.php(%d): handleError(8, 'Undefined varia...', '%s', %d, Array)
+#1 {main}
+  thrown in %sbug76025.php on line %d

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index a420a82917ea5fc8ecfc2a6eb855e3c44bb30708..968618a6aa6987f331e3552909ade332772786ab 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -213,9 +213,10 @@ static zend_always_inline zval *_get_zval_ptr_var_deref(uint32_t var, const zend
 
 static zend_never_inline ZEND_COLD void zval_undefined_cv(uint32_t var, const zend_execute_data *execute_data)
 {
-       zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
-
-       zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
+       if (EXPECTED(EG(exception) == NULL)) {
+               zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
+               zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
+       }
 }
 
 static zend_never_inline zval *_get_zval_cv_lookup(zval *ptr, uint32_t var, int type, const zend_execute_data *execute_data)