Fixed bug #70288 (Apache crash related to ZEND_SEND_REF)

diff --git a/NEWS b/NEWS
index 5aeccc879c43929dd7c1aa0590c4c1190734a217..fc67894ecbdb42c1dfc1fed2309f955a2cd12a4a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 20 Aug 2015, PHP 7.0.0 RC 1
 
 - Core:
+  . Fixed bug #70288 (Apache crash related to ZEND_SEND_REF). (Laruence)
   . Fixed bug #70262 (Accessing array crashes PHP 7.0beta3).
     (Laruence, Dmitry)
   . Fixed bug #70258 (Segfault if do_resize fails to allocated memory).

diff --git a/Zend/tests/bug70288.phpt b/Zend/tests/bug70288.phpt
new file mode 100644 (file)
index 0000000..4b55d0b
--- /dev/null
+++ b/Zend/tests/bug70288.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #70288 (Apache crash related to ZEND_SEND_REF)
+--FILE--
+<?php
+class A {
+       public function __get($name) {
+               return new Stdclass();
+       }
+}
+
+function test(&$obj) {
+       var_dump($obj);
+}
+$a = new A;
+test($a->dummy);
+?>
+--EXPECTF--
+object(stdClass)#%d (0) {
+}

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index eceed13bae5b5a735b6af7b277c19d2e24a80c65..f4afd52b18f8ba15e4998dfe64c2576db4f3c52d 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4301,9 +4301,6 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY)
        if (Z_ISREF_P(varptr)) {
                Z_ADDREF_P(varptr);
                ZVAL_COPY_VALUE(arg, varptr);
-       } else if (OP1_TYPE == IS_VAR &&
-               UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
-               ZVAL_NEW_REF(arg, varptr);
        } else {
                ZVAL_NEW_REF(arg, varptr);
                Z_ADDREF_P(arg);

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index cf1c7a1e8fb90aa32fb226e5b58077184bba6897..043dc323258847cfd00f5d865f4a83a2d6ed6163 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -15270,9 +15270,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND
        if (Z_ISREF_P(varptr)) {
                Z_ADDREF_P(varptr);
                ZVAL_COPY_VALUE(arg, varptr);
-       } else if (IS_VAR == IS_VAR &&
-               UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
-               ZVAL_NEW_REF(arg, varptr);
        } else {
                ZVAL_NEW_REF(arg, varptr);
                Z_ADDREF_P(arg);
@@ -28658,9 +28655,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_
        if (Z_ISREF_P(varptr)) {
                Z_ADDREF_P(varptr);
                ZVAL_COPY_VALUE(arg, varptr);
-       } else if (IS_CV == IS_VAR &&
-               UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
-               ZVAL_NEW_REF(arg, varptr);
        } else {
                ZVAL_NEW_REF(arg, varptr);
                Z_ADDREF_P(arg);