From 473927ece8baed35ccffe3895a90caf1d6652b53 Mon Sep 17 00:00:00 2001 From: Zeev Suraski Date: Sun, 8 Feb 2004 17:23:20 +0000 Subject: [PATCH] Fix write-mode of overloaded objects when using array dimensions --- Zend/zend_execute.c | 34 ++++++++++++++++------------------ Zend/zend_object_handlers.c | 2 +- Zend/zend_object_handlers.h | 2 +- 3 files changed, 18 insertions(+), 20 deletions(-) diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 5e8209e3d2..6117695549 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -911,26 +911,24 @@ static void zend_fetch_dimension_address(znode *result, znode *op1, znode *op2, } break; case IS_OBJECT: - if (type == BP_VAR_R || type == BP_VAR_RW) { - if (!Z_OBJ_HT_P(container)->read_dimension) { - zend_error(E_ERROR, "Cannot use object as array"); - } else { - zval *dim = get_zval_ptr(op2, Ts, &EG(free_op2), BP_VAR_R); - zval *overloaded_result = Z_OBJ_HT_P(container)->read_dimension(container, dim TSRMLS_CC); + if (!Z_OBJ_HT_P(container)->read_dimension) { + zend_error(E_ERROR, "Cannot use object as array"); + } else { + zval *dim = get_zval_ptr(op2, Ts, &EG(free_op2), BP_VAR_R); + zval *overloaded_result = Z_OBJ_HT_P(container)->read_dimension(container, dim, type TSRMLS_CC); - if (overloaded_result) { - if (type == BP_VAR_RW && !overloaded_result->is_ref) { - zend_error(E_ERROR, "Objects used as arrays in post/pre increment/decrement must return values by reference"); - } - - *retval = &overloaded_result; - } else { - *retval = &EG(error_zval_ptr); + if (overloaded_result) { + if (type == BP_VAR_RW && !overloaded_result->is_ref) { + zend_error(E_ERROR, "Objects used as arrays in post/pre increment/decrement must return values by reference"); } - AI_USE_PTR(T(result->u.var).var); - FREE_OP(Ts, op2, EG(free_op2)); - SELECTIVE_PZVAL_LOCK(**retval, result); + + *retval = &overloaded_result; + } else { + *retval = &EG(error_zval_ptr); } + AI_USE_PTR(T(result->u.var).var); + FREE_OP(Ts, op2, EG(free_op2)); + SELECTIVE_PZVAL_LOCK(**retval, result); } break; default: { @@ -1559,7 +1557,7 @@ static inline int zend_binary_assign_op_obj_helper(int (*binary_op)(zval *result z = Z_OBJ_HT_P(object)->read_property(object, property, 0 TSRMLS_CC); break; case ZEND_ASSIGN_DIM: - z = Z_OBJ_HT_P(object)->read_dimension(object, property TSRMLS_CC); + z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_W TSRMLS_CC); break; } SEPARATE_ZVAL_IF_NOT_REF(&z); diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index 415b026b09..b578b97be8 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -373,7 +373,7 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM } } -zval *zend_std_read_dimension(zval *object, zval *offset TSRMLS_DC) +zval *zend_std_read_dimension(zval *object, zval *offset, int type TSRMLS_DC) { zend_class_entry *ce = Z_OBJCE_P(object); zval *retval; diff --git a/Zend/zend_object_handlers.h b/Zend/zend_object_handlers.h index 59a571c6f7..c8d04d1db9 100644 --- a/Zend/zend_object_handlers.h +++ b/Zend/zend_object_handlers.h @@ -28,7 +28,7 @@ union _zend_function; typedef zval *(*zend_object_read_property_t)(zval *object, zval *member, zend_bool silent TSRMLS_DC); /* Used to fetch dimension from the object, read-only */ -typedef zval *(*zend_object_read_dimension_t)(zval *object, zval *offset TSRMLS_DC); +typedef zval *(*zend_object_read_dimension_t)(zval *object, zval *offset, int type TSRMLS_DC); /* Used to set property of the object */ typedef void (*zend_object_write_property_t)(zval *object, zval *member, zval *value TSRMLS_DC); -- 2.40.0