From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 2 Oct 2007 08:47:42 +0000 (+0000)
Subject: Fixed access to freed memory in tests/classes/__call_001.phpt
X-Git-Tag: RELEASE_2_0_0a1~1687
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ae9a00a64179f566b38c8f00df0c1920f33791e9;p=php

Fixed access to freed memory in tests/classes/__call_001.phpt
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 033c9943e4..14b4d5d25b 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2015,6 +2015,7 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION) {
 		ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
 		INIT_ZVAL(*(EX_T(opline->result.u.var).var.ptr));
+        EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference;
 
 		if (EX(function_state).function->common.arg_info) {
 			zend_uint i=0;
@@ -2047,8 +2048,6 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 */
 		if (!return_value_used) {
 			zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr);
-		} else {
-			EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference;
 		}
 	} else if (EX(function_state).function->type == ZEND_USER_FUNCTION) {
 		HashTable *function_symbol_table;
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 6e3c5c0097..bb1821d892 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -182,6 +182,7 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
 	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION) {
 		ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
 		INIT_ZVAL(*(EX_T(opline->result.u.var).var.ptr));
+        EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference;
 
 		if (EX(function_state).function->common.arg_info) {
 			zend_uint i=0;
@@ -214,8 +215,6 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
 */
 		if (!return_value_used) {
 			zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr);
-		} else {
-			EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference;
 		}
 	} else if (EX(function_state).function->type == ZEND_USER_FUNCTION) {
 		HashTable *function_symbol_table;