Fised possible use-after-free

diff --git a/Zend/tests/generators/yield_from_iterator_agregate.phpt b/Zend/tests/generators/yield_from_iterator_agregate.phpt
new file mode 100644 (file)
index 0000000..3bd61e0
--- /dev/null
+++ b/Zend/tests/generators/yield_from_iterator_agregate.phpt
@@ -0,0 +1,17 @@
+--TEST--
+yield from with an IteratorAggregate
+--FILE--
+<?php
+class foo implements \IteratorAggregate {
+  public $prop = 1;
+  function getIterator() {
+    var_dump($this->prop);
+    yield;
+  }
+}
+(function(){
+  yield from new foo;
+})()->next();
+?>
+--EXPECT--
+int(1)

diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c
index 8dfa2a975456239e8d5ab4403ff5ffd9147c98d3..cbcc774c5e56d93dfd01c195e61f47b215cae0b2 100644 (file)
--- a/Zend/zend_generators.c
+++ b/Zend/zend_generators.c
@@ -334,8 +334,9 @@ ZEND_API void zend_generator_create_zval(zend_execute_data *call, zend_op_array
 
        object_init_ex(return_value, zend_ce_generator);
 
-       if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
-               Z_ADDREF(call->This);
+       if (Z_TYPE(EX(This)) == IS_OBJECT && !(EX_CALL_INFO() & ZEND_CALL_CLOSURE)) {
+               ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_RELEASE_THIS);
+               Z_ADDREF(EX(This));
        }
 
        /* Save execution context in generator object. */