From ae9a00a64179f566b38c8f00df0c1920f33791e9 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Tue, 2 Oct 2007 08:47:42 +0000 Subject: [PATCH] Fixed access to freed memory in tests/classes/__call_001.phpt --- Zend/zend_vm_def.h | 3 +-- Zend/zend_vm_execute.h | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 033c9943e4..14b4d5d25b 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -2015,6 +2015,7 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY) if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION) { ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr); INIT_ZVAL(*(EX_T(opline->result.u.var).var.ptr)); + EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference; if (EX(function_state).function->common.arg_info) { zend_uint i=0; @@ -2047,8 +2048,6 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY) */ if (!return_value_used) { zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr); - } else { - EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference; } } else if (EX(function_state).function->type == ZEND_USER_FUNCTION) { HashTable *function_symbol_table; diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 6e3c5c0097..bb1821d892 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -182,6 +182,7 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS) if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION) { ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr); INIT_ZVAL(*(EX_T(opline->result.u.var).var.ptr)); + EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference; if (EX(function_state).function->common.arg_info) { zend_uint i=0; @@ -214,8 +215,6 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS) */ if (!return_value_used) { zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr); - } else { - EX_T(opline->result.u.var).var.fcall_returned_reference = EX(function_state).function->common.return_reference; } } else if (EX(function_state).function->type == ZEND_USER_FUNCTION) { HashTable *function_symbol_table; -- 2.50.1