From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 29 Jun 2015 08:35:12 +0000 (+0300)
Subject: Don't evaluate invalid constant expressions.
X-Git-Tag: php-7.1.0alpha3~25^2~122
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=625dba022c69dc499ecab39801d90baa9fbb2120;p=php

Don't evaluate invalid constant expressions.
---

diff --git a/ext/opcache/Optimizer/block_pass.c b/ext/opcache/Optimizer/block_pass.c
index 8694b4b61a..8b85422d2f 100644
--- a/ext/opcache/Optimizer/block_pass.c
+++ b/ext/opcache/Optimizer/block_pass.c
@@ -988,10 +988,14 @@ static void zend_optimize_block(zend_code_block *block, zend_op_array *op_array,
 			int er;
 
             if ((opline->opcode == ZEND_DIV || opline->opcode == ZEND_MOD) &&
-                ((Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_LONG &&
-                  Z_LVAL(ZEND_OP2_LITERAL(opline)) == 0) ||
-                 (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_DOUBLE &&
-                  Z_DVAL(ZEND_OP2_LITERAL(opline)) == 0.0))) {
+                zval_get_long(&ZEND_OP2_LITERAL(opline)) == 0) {
+				if (RESULT_USED(opline)) {
+					SET_VAR_SOURCE(opline);
+				}
+                opline++;
+				continue;
+            } else if ((opline->opcode == ZEND_SL || opline->opcode == ZEND_SR) &&
+                zval_get_long(&ZEND_OP2_LITERAL(opline)) < 0) {
 				if (RESULT_USED(opline)) {
 					SET_VAR_SOURCE(opline);
 				}
diff --git a/ext/opcache/Optimizer/pass1_5.c b/ext/opcache/Optimizer/pass1_5.c
index 611b39df24..ec6cf15c7f 100644
--- a/ext/opcache/Optimizer/pass1_5.c
+++ b/ext/opcache/Optimizer/pass1_5.c
@@ -74,11 +74,14 @@ void zend_optimizer_pass1(zend_op_array *op_array, zend_optimizer_ctx *ctx)
 				zval result;
 				int er;
 
-				if (opline->opcode == ZEND_DIV &&
-					Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_LONG &&
-					Z_LVAL(ZEND_OP2_LITERAL(opline)) == 0) {
+				if ((opline->opcode == ZEND_DIV || opline->opcode == ZEND_MOD) &&
+					zval_get_long(&ZEND_OP2_LITERAL(opline)) == 0) {
 					/* div by 0 */
 					break;
+				} else if ((opline->opcode == ZEND_SL || opline->opcode == ZEND_SR) &&
+					zval_get_long(&ZEND_OP2_LITERAL(opline)) < 0) {
+					/* shift by negative number */
+					break;
 				}
 				er = EG(error_reporting);
 				EG(error_reporting) = 0;