From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 1 Jun 2015 09:17:32 +0000 (+0300)
Subject: Merge branch 'PHP-5.5' into PHP-5.6
X-Git-Tag: php-7.0.0alpha1~55^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f863d89b5cc991ebfbb69caacc724ad90513924b;p=php

Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  Fixed bug #69732 (can induce segmentation fault with basic php code).

Conflicts:
	Zend/zend_vm_execute.h
---

f863d89b5cc991ebfbb69caacc724ad90513924b
diff --cc NEWS
index f961ed7d3b,0463d11dcb..070438572b
--- a/NEWS
+++ b/NEWS
@@@ -1,21 -1,18 +1,23 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2015, PHP 5.5.26
 +?? Jul 2015, PHP 5.6.11
 +
 +11 Jun 2015, PHP 5.6.10
  
  - Core:
 -  . Fixed bug #69566 (Conditional jump or move depends on uninitialised value
 -    in extension trait). (jbboehr at gmail dot com)
    . Fixed bug #66048 (temp. directory is cached during multiple requests).
      (Julien)
 +  . Fixed bug #69566 (Conditional jump or move depends on uninitialised value
 +    in extension trait). (jbboehr at gmail dot com)
 +  . Fixed bug #69599 (Strange generator+exception+variadic crash). (Nikita)
    . Fixed bug #69628 (complex GLOB_BRACE fails on Windows).
      (Christoph M. Becker)
 +  . Fixed POST data processing slowdown due to small input buffer size
 +    on Windows. (Jorge Oliveira, Anatol)
    . Fixed bug #69703 (Use __builtin_clzl on PowerPC).
      (dja at axtens dot net, Kalle)
+   . Fixed bug #69732 (can induce segmentation fault with basic php code).
+     (Dmitry)
  
  - GD:
    . Fixed bug #69479 (GD fails to build with newer libvpx). (Remi)
diff --cc Zend/zend_vm_def.h
index 7c029ada3f,94b65e4939..c7b2d2a934
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@@ -1753,7 -1762,9 +1753,9 @@@ ZEND_VM_HANDLER(38, ZEND_ASSIGN, VAR|CV
  		}
  	}
  
- 	FREE_OP1_VAR_PTR();
+ 	if (OP1_TYPE == IS_VAR && OP1_FREE) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
  
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
   	FREE_OP2_IF_VAR();
diff --cc Zend/zend_vm_execute.h
index 1f5e55f40d,0b2b24c46e..0de6b4ab57
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@@ -15692,7 -15307,9 +15692,9 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
- 	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+ 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
  
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
  
@@@ -18043,7 -17664,9 +18045,9 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
- 	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+ 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
  
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
  
@@@ -20303,10 -19927,12 +20307,12 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
- 	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+ 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
  
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
 - 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
 + 	zval_ptr_dtor_nogc(&free_op2.var);
  
  	CHECK_EXCEPTION();
  	ZEND_VM_NEXT_OPCODE();
@@@ -23772,7 -23401,9 +23778,9 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
- 	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+ 	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
  
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
  
@@@ -33211,6 -32836,10 +33219,10 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
+ 	if (IS_CV == IS_VAR && 0) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
+ 
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
  
  	CHECK_EXCEPTION();
@@@ -35331,6 -34960,10 +35343,10 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
+ 	if (IS_CV == IS_VAR && 0) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
+ 
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
  
  	CHECK_EXCEPTION();
@@@ -37452,8 -37087,12 +37468,12 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
+ 	if (IS_CV == IS_VAR && 0) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
+ 
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
 - 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
 + 	zval_ptr_dtor_nogc(&free_op2.var);
  
  	CHECK_EXCEPTION();
  	ZEND_VM_NEXT_OPCODE();
@@@ -40632,6 -40276,10 +40652,10 @@@ static int ZEND_FASTCALL  ZEND_ASSIGN_S
  		}
  	}
  
+ 	if (IS_CV == IS_VAR && 0) {
 -		zval_ptr_dtor(&value);
++		zval_ptr_dtor_nogc(&value);
+ 	}
+ 
  	/* zend_assign_to_variable() always takes care of op2, never free it! */
  
  	CHECK_EXCEPTION();