From: Xinchen Hui <laruence@gmail.com>
Date: Sun, 12 Feb 2017 12:36:18 +0000 (+0800)
Subject: Merge branch 'PHP-7.0' into PHP-7.1
X-Git-Tag: php-7.1.3RC1~39
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b56114e8fb90098e4f56e8bea92c8d5450a76483;p=php

Merge branch 'PHP-7.0' into PHP-7.1

* PHP-7.0:
  Fixed bug #74084 (Out of bound read - zend_mm_alloc_small)

Conflicts:
	Zend/zend_operators.c
---

b56114e8fb90098e4f56e8bea92c8d5450a76483
diff --cc Zend/zend_operators.c
index f2213c1a68,3a8929b83f..418d2f03ea
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@@ -951,8 -926,13 +951,13 @@@ ZEND_API int ZEND_FASTCALL add_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_ADD, add_function);
  
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");
@@@ -993,8 -984,13 +998,13 @@@ ZEND_API int ZEND_FASTCALL sub_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_SUB, sub_function);
  
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");
@@@ -1040,8 -1036,13 +1050,13 @@@ ZEND_API int ZEND_FASTCALL mul_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_MUL, mul_function);
  
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");
@@@ -1118,17 -1119,27 +1133,27 @@@ ZEND_API int ZEND_FASTCALL pow_function
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_POW, pow_function);
  
- 					if (Z_TYPE_P(op1) == IS_ARRAY) {
- 						ZVAL_LONG(result, 0);
- 						return SUCCESS;
- 					} else {
- 						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					}
- 					if (Z_TYPE_P(op2) == IS_ARRAY) {
- 						ZVAL_LONG(result, 1L);
- 						return SUCCESS;
+ 					if (EXPECTED(op1 != op2)) {
+ 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+ 							ZVAL_LONG(result, 0);
+ 							return SUCCESS;
+ 						} else {
 -							zendi_convert_scalar_to_number(op1, op1_copy, result);
++							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						}
+ 						if (Z_TYPE_P(op2) == IS_ARRAY) {
+ 							ZVAL_LONG(result, 1L);
+ 							return SUCCESS;
+ 						} else {
 -							zendi_convert_scalar_to_number(op2, op2_copy, result);
++							zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 						}
  					} else {
- 						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+ 							ZVAL_LONG(result, 0);
+ 							return SUCCESS;
+ 						} else {
 -							zendi_convert_scalar_to_number(op1, op1_copy, result);
++							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						}
+ 						op2 = op1;
  					}
  					converted = 1;
  				} else {
@@@ -1192,9 -1203,13 +1217,14 @@@ ZEND_API int ZEND_FASTCALL div_function
  					op2 = Z_REFVAL_P(op2);
  				} else if (!converted) {
  					ZEND_TRY_BINARY_OBJECT_OPERATION(ZEND_DIV, div_function);
 +
- 					zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
- 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					if (EXPECTED(op1 != op2)) {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
 -						zendi_convert_scalar_to_number(op2, op2_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
++						zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
+ 					} else {
 -						zendi_convert_scalar_to_number(op1, op1_copy, result);
++						zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
+ 						op2 = op1;
+ 					}
  					converted = 1;
  				} else {
  					zend_throw_error(NULL, "Unsupported operand types");