From: Nikita Popov <nikic@php.net>
Date: Sat, 26 Apr 2014 08:40:12 +0000 (+0200)
Subject: Fix by-reference argument unpacking
X-Git-Tag: POST_PHPNG_MERGE~412^2~37
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4cd97b3ebd89217094fad0ecabcc281cd35f8864;p=php

Fix by-reference argument unpacking
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index d2db9e0d4f..1cfd7650c8 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3150,7 +3150,7 @@ ZEND_VM_C_LABEL(send_again):
 	switch (Z_TYPE_P(args)) {
 		case IS_ARRAY: {
 			HashTable *ht = Z_ARRVAL_P(args);
-			zval *arg;
+			zval *arg, *top;
 			zend_string *name;
 
 			ZEND_VM_STACK_GROW_IF_NEEDED(zend_hash_num_elements(ht));
@@ -3163,16 +3163,17 @@ ZEND_VM_C_LABEL(send_again):
 					ZEND_VM_NEXT_OPCODE();
 				}
 
+				top = zend_vm_stack_top_inc(TSRMLS_C);
 				if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, arg_num)) {
 					SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
 					Z_ADDREF_P(arg);
+					ZVAL_COPY_VALUE(top, arg);
 				} else if (Z_ISREF_P(arg)) {
-					ZVAL_DUP(arg, Z_REFVAL_P(arg));
+					ZVAL_DUP(top, Z_REFVAL_P(arg));
 				} else {
-					if (Z_REFCOUNTED_P(arg)) Z_ADDREF_P(arg);
+					ZVAL_COPY(top, arg);
 				}
 
-				zend_vm_stack_push(arg TSRMLS_CC);
 				EX(call)->num_additional_args++;
 				arg_num++;
 			} ZEND_HASH_FOREACH_END();
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 33850c8fc5..4e10970798 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -750,7 +750,7 @@ send_again:
 	switch (Z_TYPE_P(args)) {
 		case IS_ARRAY: {
 			HashTable *ht = Z_ARRVAL_P(args);
-			zval *arg;
+			zval *arg, *top;
 			zend_string *name;
 
 			ZEND_VM_STACK_GROW_IF_NEEDED(zend_hash_num_elements(ht));
@@ -763,16 +763,17 @@ send_again:
 					ZEND_VM_NEXT_OPCODE();
 				}
 
+				top = zend_vm_stack_top_inc(TSRMLS_C);
 				if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->fbc, arg_num)) {
 					SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
 					Z_ADDREF_P(arg);
+					ZVAL_COPY_VALUE(top, arg);
 				} else if (Z_ISREF_P(arg)) {
-					ZVAL_DUP(arg, Z_REFVAL_P(arg));
+					ZVAL_DUP(top, Z_REFVAL_P(arg));
 				} else {
-					if (Z_REFCOUNTED_P(arg)) Z_ADDREF_P(arg);
+					ZVAL_COPY(top, arg);
 				}
 
-				zend_vm_stack_push(arg TSRMLS_CC);
 				EX(call)->num_additional_args++;
 				arg_num++;
 			} ZEND_HASH_FOREACH_END();