Fixed bug #34310 (foreach($arr as $c->d => $x) crashes)

diff --git a/NEWS b/NEWS
index c881bce6a71eeea032891bd63beb99bede765adc..f1d7939e888ebdb0925f7b3f2aea4b98a2276094 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ PHP                                                                        NEWS
   defined using reflection API. (Johannes)
 - Fixed a bug where stream_get_meta_data() did not return the "uri" element for
   files opened with tmpname(). (Derick)
+- Fixed bug #34310 (foreach($arr as $c->d => $x) crashes). (Dmitry)
 - Fixed bug #34302 (date('W') do not return leading zeros for week 1 to 9).
   (Derick)
 - Fixed bug #33957 (gmdate('W')/date('W') sometimes returns wrong week number).

diff --git a/Zend/tests/bug34310.phpt b/Zend/tests/bug34310.phpt
index 2f7c477149f865a94ec0e38fe6e34e6d067b4613..1d2bb03ad3e5088f15ed6391969fb7b7c2222891 100644 (file)
--- a/Zend/tests/bug34310.phpt
+++ b/Zend/tests/bug34310.phpt
@@ -5,7 +5,7 @@ Bug #34310 (foreach($arr as $c->d => $x) crashes)
 
 class C
 {
-       var $d;
+       public $d;
 }
 
 $c = new C();

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 2c078284c29e5e9e4861ec9cfeebd47f51832d02..606e4a9090dcacba456f2a5b700efc01def7390f 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -572,14 +572,20 @@ void zend_do_assign(znode *result, znode *variable, znode *value TSRMLS_DC)
        if (last_op_number > 0) {
                zend_op *last_op = &CG(active_op_array)->opcodes[last_op_number-1];
 
-               if (last_op->opcode == ZEND_FETCH_OBJ_W) {
+               if (variable->op_type == IS_VAR &&
+                   last_op->opcode == ZEND_FETCH_OBJ_W &&
+                   last_op->result.op_type == IS_VAR &&
+                   last_op->result.u.var == variable->u.var) {
                        last_op->opcode = ZEND_ASSIGN_OBJ;
 
                        zend_do_op_data(opline, value TSRMLS_CC);
                        SET_UNUSED(opline->result);
                        *result = last_op->result;
                        return;
-               } else if (last_op->opcode == ZEND_FETCH_DIM_W) {
+               } else if (variable->op_type == IS_VAR &&
+                          last_op->opcode == ZEND_FETCH_DIM_W &&
+                          last_op->result.op_type == IS_VAR &&
+                          last_op->result.u.var == variable->u.var) {
                        last_op->opcode = ZEND_ASSIGN_DIM;
 
                        zend_do_op_data(opline, value TSRMLS_CC);