From: Xinchen Hui <laruence@php.net>
Date: Tue, 11 Aug 2015 13:42:11 +0000 (+0800)
Subject: Fixed bug #70240 (Segfault when doing unset($var());)
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4064ee30615280396db27ee86afafaf2a00dc9c9;p=php

Fixed bug #70240 (Segfault when doing unset($var());)
---

diff --git a/NEWS b/NEWS
index 2a6eda99b4..9437c0f440 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 20 Aug 2015, PHP 7.0.0 RC 1
 
 - Core:
+  . Fixed bug #70240 (Segfault when doing unset($var());). (Laruence)
   . Fixed bug #70223 (Incrementing value returned by magic getter). (Laruence)
   . Fixed bug #70215 (Segfault when __invoke is static). (Bob)
   . Fixed bug #70207 (Finally is broken with opcache). (Laruence, Dmitry)
diff --git a/Zend/tests/bug70240.phpt b/Zend/tests/bug70240.phpt
new file mode 100644
index 0000000000..d2aae2137d
--- /dev/null
+++ b/Zend/tests/bug70240.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Bug #70240 (Segfault when doing unset($var()))
+--FILE--
+<?php
+unset($var());
+?>
+--EXPECTF--
+Fatal error: Can't use function return value in write context in %sbug70240.php on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index c669c1f5cc..606775a11a 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3428,9 +3428,11 @@ void zend_compile_static_var(zend_ast *ast) /* {{{ */
 void zend_compile_unset(zend_ast *ast) /* {{{ */
 {
 	zend_ast *var_ast = ast->child[0];
-
 	znode var_node;
 	zend_op *opline;
+
+	zend_ensure_writable_variable(var_ast);
+
 	switch (var_ast->kind) {
 		case ZEND_AST_VAR:
 			if (zend_try_compile_cv(&var_node, var_ast) == SUCCESS) {