From: Dmitry Stogov <dmitry@php.net>
Date: Mon, 17 Oct 2005 08:01:07 +0000 (+0000)
Subject: Fixed bug #34873 (Segmentation Fault on foreach in object)
X-Git-Tag: RELEASE_0_9_1~98
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bc446eec5b8551da0b1c93e0b06132cbc90af233;p=php

Fixed bug #34873 (Segmentation Fault on foreach in object)
---

diff --git a/Zend/tests/bug34873.phpt b/Zend/tests/bug34873.phpt
index d8683c991f..ac7eb209e5 100644
--- a/Zend/tests/bug34873.phpt
+++ b/Zend/tests/bug34873.phpt
@@ -25,3 +25,6 @@ echo "Done\n";
 --EXPECT--	
 string(7) "myvalue"
 Done
+--UEXPECT--
+unicode(7) "myvalue"
+Done
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index fdda529d5a..66082ba84b 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3792,6 +3792,8 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z
 	}
 
 	value_node = opline->result;
+	
+	zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
 	if (assign_by_ref) {
 		/* Mark FE_FETCH as IS_VAR as it holds the data directly as a value */
 		zend_do_assign_ref(NULL, value, &value_node TSRMLS_CC);
@@ -3803,6 +3805,7 @@ void zend_do_foreach_cont(znode *foreach_token, znode *as_token, znode *value, z
 	if (key->op_type != IS_UNUSED) {
 		znode key_node;
 
+		zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
 		opline = &CG(active_op_array)->opcodes[as_token->u.opline_num+1];
 		opline->result.op_type = IS_TMP_VAR;
 		opline->result.u.EA.type = 0;
diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y
index eb76c5ea19..a996378133 100644
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@@ -222,7 +222,7 @@ unticked_statement:
 		foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
 	|	T_FOREACH '(' expr_without_variable { zend_do_foreach_begin(&$1, &$2, &$3, 0 TSRMLS_CC); } T_AS 
 		{ zend_do_foreach_fetch(&$1, &$2, &$5 TSRMLS_CC); } 
-		w_variable foreach_optional_arg ')' { zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); } 
+		variable foreach_optional_arg ')' { zend_check_writable_variable(&$7); zend_do_foreach_cont(&$1, &$5, &$7, &$8 TSRMLS_CC); } 
 		foreach_statement { zend_do_foreach_end(&$1, &$5 TSRMLS_CC); }
 	|	T_DECLARE { $1.u.opline_num = get_next_op_number(CG(active_op_array)); zend_do_declare_begin(TSRMLS_C); } '(' declare_list ')' declare_statement { zend_do_declare_end(&$1 TSRMLS_CC); }
 	|	';'		/* empty statement */
@@ -340,8 +340,8 @@ foreach_optional_arg:
 
 
 foreach_variable:
-		w_variable			{ $$ = $1; }
-	|	'&' w_variable		{ $$ = $2;  $$.u.EA.type |= ZEND_PARSED_REFERENCE_VARIABLE; }
+		variable			{ zend_check_writable_variable(&$1); $$ = $1; }
+	|	'&' variable		{ zend_check_writable_variable(&$2); $$ = $2;  $$.u.EA.type |= ZEND_PARSED_REFERENCE_VARIABLE; }
 ;
 
 for_statement: