From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 3 Oct 2006 09:05:14 +0000 (+0000)
Subject: Fixed bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults)
X-Git-Tag: php-5.2.0RC5~37
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9875fe44e21cb98a274e1b8d0938ff1e13888012;p=php

Fixed bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults)
---

diff --git a/NEWS b/NEWS
index 63314e3d71..cabb18e634 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ PHP                                                                        NEWS
 - Fixed mess with CGI/CLI -d option (now it works with cgi; constants are
   working exactly like in php.ini; with FastCGI -d affects all requests).
   (Dmitry)
+- Fixed bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults).
+  (Dmitry)
 - Fixed bug #39004 (Fixed generation of config.nice with autoconf 2.60).
   (Ilia)
 - Fixed bug #39003 (__autoload() is called for type hinting). (Dmitry, Tony)
diff --git a/Zend/tests/bug39017.phpt b/Zend/tests/bug39017.phpt
new file mode 100755
index 0000000000..70204758d5
--- /dev/null
+++ b/Zend/tests/bug39017.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults)
+--FILE--
+<?php
+class A {}
+foreach(($a=(object)new A()) as $v);
+var_dump($a); // UNKNOWN:0
+?>
+--EXPECTF--
+object(A)#%d (0) {
+}
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 074a48ea99..ef44ed108a 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3106,6 +3106,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 			array_ptr = tmp;
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
+			if (!ce || !ce->get_iterator) {
+				array_ptr->refcount++;
+			}
 		} else {
 			if (OP1_TYPE == IS_VAR &&
 				free_op1.var == NULL &&
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index aff983bd26..f23e6ab835 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2165,6 +2165,9 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			array_ptr = tmp;
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
+			if (!ce || !ce->get_iterator) {
+				array_ptr->refcount++;
+			}
 		} else {
 			if (IS_CONST == IS_VAR &&
 				free_op1.var == NULL &&
@@ -4701,6 +4704,9 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			array_ptr = tmp;
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
+			if (!ce || !ce->get_iterator) {
+				array_ptr->refcount++;
+			}
 		} else {
 			if (IS_TMP_VAR == IS_VAR &&
 				free_op1.var == NULL &&
@@ -7819,6 +7825,9 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			array_ptr = tmp;
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
+			if (!ce || !ce->get_iterator) {
+				array_ptr->refcount++;
+			}
 		} else {
 			if (IS_VAR == IS_VAR &&
 				free_op1.var == NULL &&
@@ -19853,6 +19862,9 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			array_ptr = tmp;
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
+			if (!ce || !ce->get_iterator) {
+				array_ptr->refcount++;
+			}
 		} else {
 			if (IS_CV == IS_VAR &&
 				free_op1.var == NULL &&