From ee04ea7935730b2ebfd734fbaf305bf01f43f647 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Mon, 7 Dec 2009 08:47:18 +0000 Subject: [PATCH] Fixed bug #49866 (Making reference on string offsets crashes PHP) --- Zend/tests/bug49866.phpt | 10 ++++++++++ Zend/zend_vm_def.h | 2 +- Zend/zend_vm_execute.h | 20 ++++++++++---------- 3 files changed, 21 insertions(+), 11 deletions(-) create mode 100644 Zend/tests/bug49866.phpt diff --git a/Zend/tests/bug49866.phpt b/Zend/tests/bug49866.phpt new file mode 100644 index 0000000000..7fbc0d8028 --- /dev/null +++ b/Zend/tests/bug49866.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #49866 (Making reference on string offsets crashes PHP) +--FILE-- +extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 620719aff7..4ef71d6d75 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -10257,7 +10257,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HA if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -12170,7 +12170,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HAND if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -13988,7 +13988,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HAND if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -15394,7 +15394,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_H if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -16455,7 +16455,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDL if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -24637,7 +24637,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HAN } /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -26369,7 +26369,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDL } /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -28075,7 +28075,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDL } /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -29368,7 +29368,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HA } /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -30327,7 +30327,7 @@ static int ZEND_FASTCALL ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLE } /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value && EX_T(opline->result.u.var).var.ptr_ptr) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); -- 2.40.0