Fixed bug #34062 (Crash in catch block when many arguments are used)

diff --git a/NEWS b/NEWS
index f7dedb1c9f151c525a29cd7175652ba1f815b43b..6988c653ba2c29b7b4a2e1b597cd0eab11e349d2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
   (Andrey)
 - Fixed bug #34064 (arr[] as param to function in class gives invalid opcode).
   (Dmitry)
+- Fixed bug #34062 (Crash in catch block when many arguments are used).
+  (Dmitry)
 - Fixed bug #34045 (Buffer overflow with serialized object). (Dmitry)
 - Fixed bug #33999 (object remains object when cast to int). (Dmitry)
 - Fixed bug #33996 (No information given for fatal error on passing invalid

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 805c31cb0bc790db2214643c4c0ca10b7bfc2e09..b96d1a1e7f80a80f72181a7ce3dd558f78c49932 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3579,6 +3579,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
        while (*stack_zval_pp != NULL) {
                zval_ptr_dtor(stack_zval_pp);
                EG(argument_stack).top_element--;
+               EG(argument_stack).top--;
                stack_zval_pp--;
        }
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 81a60695f8b44ca1db53775af02639e32a3a6a9e..c60cef5c88c3a3c08fe5af4e2992891e3db3d20d 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -520,6 +520,7 @@ static int ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        while (*stack_zval_pp != NULL) {
                zval_ptr_dtor(stack_zval_pp);
                EG(argument_stack).top_element--;
+               EG(argument_stack).top--;
                stack_zval_pp--;
        }