From: Xinchen Hui <laruence@php.net>
Date: Mon, 10 Nov 2014 05:46:47 +0000 (+0800)
Subject: Fixed bug #68370 ("unset($this)" can make the program crash)
X-Git-Tag: php-5.5.20RC1~37^2~37^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ab849392549c41fd3fc3d6ed2a324688f2afe47d;p=php

Fixed bug #68370 ("unset($this)" can make the program crash)
---

diff --git a/NEWS b/NEWS
index 9e5e1388c8..79a2b8893f 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ PHP                                                                        NEWS
 ?? ??? 2014, PHP 5.5.19
 
 - Core:
+  . Fixed bug #68370 ("unset($this)" can make the program crash). (Laruence)
   . Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in 
     php_getopt()). (Stas)
   . Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita)
diff --git a/Zend/tests/bug68370.phpt b/Zend/tests/bug68370.phpt
new file mode 100644
index 0000000000..25589bf455
--- /dev/null
+++ b/Zend/tests/bug68370.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68370 "unset($this)" can make the program crash
+--FILE--
+<?php
+class C {
+	public function test() {
+		unset($this);
+		return get_defined_vars();
+	}
+}
+$c = new C();
+$x = $c->test();
+print_r($x);
+unset($c, $x);
+--EXPECTF--
+Array
+(
+)
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 7e2a3378da..9d4eebf010 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -1761,13 +1761,6 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */
 				/*printf("Cache miss!  Initialized %x\n", EG(active_symbol_table));*/
 			}
 			ex->symbol_table = EG(active_symbol_table);
-
-			if (ex->op_array->this_var != -1 &&
-			    !*EX_CV_NUM(ex, ex->op_array->this_var) &&
-			    EG(This)) {
-			    *EX_CV_NUM(ex, ex->op_array->this_var) = (zval**)EX_CV_NUM(ex, ex->op_array->last_var + ex->op_array->this_var);
-				**EX_CV_NUM(ex, ex->op_array->this_var) = EG(This);
- 			}
 			for (i = 0; i < ex->op_array->last_var; i++) {
 				if (*EX_CV_NUM(ex, i)) {
 					zend_hash_quick_update(EG(active_symbol_table),