From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 15 Jan 2008 11:53:13 +0000 (+0000)
Subject: Fixed bug #43851 (Memory corrution on reuse of assigned value)
X-Git-Tag: RELEASE_2_0_0a1~893
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2d8f3f9b72b985fb1fa51b38fda8aa42b564c634;p=php

Fixed bug #43851 (Memory corrution on reuse of assigned value)
---

diff --git a/Zend/tests/bug43851.phpt b/Zend/tests/bug43851.phpt
new file mode 100644
index 0000000000..e19e393df0
--- /dev/null
+++ b/Zend/tests/bug43851.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #43851 (Memory corrution on reuse of assigned value)
+--FILE--
+<?php
+foo();
+function foo() {
+	global $LAST;
+	($LAST = $LAST + 0) * 1;
+	echo "ok\n";
+}
+?>
+--EXPECT--
+ok
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index af7a6d1d07..c131edf99a 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -756,7 +756,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
 
 	if (Z_TYPE_P(variable_ptr) == IS_OBJECT && Z_OBJ_HANDLER_P(variable_ptr, set)) {
 		Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr_ptr, value TSRMLS_CC);
-		return value;
+		return variable_ptr;
 	}
 
 	if (PZVAL_IS_REF(variable_ptr)) {
@@ -775,7 +775,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
 				Z_DELREF_P(value);
 			}
 			zendi_zval_dtor(garbage);
-			return value;
+			return variable_ptr;
 		}
 	} else {
 		if (Z_DELREF_P(variable_ptr) == 0) {