Fixed bug #70323 (Regression in zend_fetch_debug_backtrace() can cause segfaults)

diff --git a/NEWS b/NEWS
index 606bb045a0b3487a4a2b9f423e7ede8b119c8e54..f45a930cbc47681942e3a0e9c6daef38a97416d1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
   . Fixed bug #70863 (Incorect logic to increment_function for proxy objects).
     (Anatol)
   . Fixed bug #70842 (Persistent Stream Segmentation Fault). (Caleb Champlin)
+  . Fixed bug #70323 (Regression in zend_fetch_debug_backtrace() can cause
+    segfaults). (Aharvey, Laruence)
 
 - Opcache:
   . Fixed bug #70843 (Segmentation fault on MacOSX with

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 8ffdcaa0bc4548db041021e9c753b7c44a477573..6faa57cd99e2933758f54dccd26d2d85c08cb20c 100644 (file)
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -2481,7 +2481,7 @@ ZEND_FUNCTION(debug_print_backtrace)
 
 ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int options, int limit) /* {{{ */
 {
-       zend_execute_data *call, *ptr, *skip;
+       zend_execute_data *ptr, *skip, *call = NULL;
        zend_object *object;
        int lineno, frameno = 0;
        zend_function *func;
@@ -2490,8 +2490,12 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
        zend_string *include_filename = NULL;
        zval stack_frame;
 
-       call = NULL;
-       ptr = EG(current_execute_data);
+       array_init(return_value);
+
+       if (!(ptr = EG(current_execute_data))) {
+               return;
+       }
+
        if (!ptr->func || !ZEND_USER_CODE(ptr->func->common.type)) {
                call = ptr;
                ptr = ptr->prev_execute_data;
@@ -2509,13 +2513,11 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
                                ptr = ptr->prev_execute_data;
                        }
                }
+               if (!call) {
+                       call = ptr;
+                       ptr = ptr->prev_execute_data;
+               }
        }
-       if (!call) {
-               call = ptr;
-               ptr = ptr->prev_execute_data;
-       }
-
-       array_init(return_value);
 
        while (ptr && (limit == 0 || frameno < limit)) {
                frameno++;