From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 4 Apr 2016 06:35:48 +0000 (+0300)
Subject: Fised possible use-after-free
X-Git-Tag: php-7.1.0alpha1~388^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e7730fece6bc68bc3c2835c3fd3da4999496878c;p=php

Fised possible use-after-free
---

diff --git a/Zend/tests/generators/yield_from_iterator_agregate.phpt b/Zend/tests/generators/yield_from_iterator_agregate.phpt
new file mode 100644
index 0000000000..3bd61e0b5a
--- /dev/null
+++ b/Zend/tests/generators/yield_from_iterator_agregate.phpt
@@ -0,0 +1,17 @@
+--TEST--
+yield from with an IteratorAggregate
+--FILE--
+<?php
+class foo implements \IteratorAggregate {
+  public $prop = 1;
+  function getIterator() {
+    var_dump($this->prop);
+    yield;
+  }
+}
+(function(){
+  yield from new foo;
+})()->next();
+?>
+--EXPECT--
+int(1)
diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c
index 8dfa2a9754..cbcc774c5e 100644
--- a/Zend/zend_generators.c
+++ b/Zend/zend_generators.c
@@ -334,8 +334,9 @@ ZEND_API void zend_generator_create_zval(zend_execute_data *call, zend_op_array
 
 	object_init_ex(return_value, zend_ce_generator);
 
-	if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
-		Z_ADDREF(call->This);
+	if (Z_TYPE(EX(This)) == IS_OBJECT && !(EX_CALL_INFO() & ZEND_CALL_CLOSURE)) {
+		ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_RELEASE_THIS);
+		Z_ADDREF(EX(This));
 	}
 
 	/* Save execution context in generator object. */