Fixes

4 files changed, 14 insertions, 6 deletions

diff --git a/Zend/zend-scanner.l b/Zend/zend-scanner.l
index 2e3006574c..587fbb8278 100644
--- a/Zend/zend-scanner.l
+++ b/Zend/zend-scanner.l
@@ -1036,7 +1036,7 @@ ESCAPED_AND_WHITESPACE [\n\t\r #'.:;,()|^&+-/*=%!~<>?@]+
 	return T_PHP_TRACK_VARS;
 }
 
-<ST_IN_SCRIPTING,ST_DOUBLE_QUOTES,ST_HEREDOC>"$"{LABEL} {
+<ST_IN_SCRIPTING,ST_DOUBLE_QUOTES,ST_HEREDOC,ST_BACKQUOTE>"$"{LABEL} {
 	zendlval->value.str.val = (char *)estrndup(yytext+1, yyleng-1);
 	zendlval->value.str.len = yyleng-1;
 	zendlval->type = IS_STRING;
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index fac2c1db28..b9f5ef1276 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1372,6 +1372,7 @@ void do_shell_exec(znode *result, znode *cmd CLS_DC)
 	opline->op1.u.constant.is_ref = 0;
 	opline->op1.u.constant.type = IS_STRING;
 	opline->op1.op_type = IS_CONST;
+	opline->extended_value = 1;
 	SET_UNUSED(opline->op2);
 	*result = opline->result;
 }
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index f678d72d4b..cce74d6bd7 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -203,7 +203,7 @@ static inline zval **zend_fetch_property_address_inner(HashTable *ht, znode *op2
 }
 
 
-static inline void zend_assign_to_variable(znode *result, znode *op1, zval *value, int type, temp_variable *Ts ELS_DC)
+static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2, zval *value, int type, temp_variable *Ts ELS_DC)
 {
 	zval **variable_ptr_ptr = get_zval_ptr_ptr(op1, Ts, BP_VAR_W);
 	zval *variable_ptr;
@@ -231,6 +231,11 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, zval *valu
 						}
 
 						T->EA.str->value.str.val[T->EA.offset] = value->value.str.val[0];
+						if (op2
+							&& op2->op_type == IS_VAR
+							&& value==&Ts[op2->u.var].tmp_var) {
+							efree(value->value.str.val);
+						}
 						if (value == &tmp) {
 							zval_dtor(value);
 						}
@@ -1073,7 +1078,7 @@ binary_assign_op_addr: {
 			case ZEND_ASSIGN: {
 					zval *value = get_zval_ptr(&opline->op2, Ts, &free_op2, BP_VAR_R);
 
-					zend_assign_to_variable(&opline->result, &opline->op1, value, (free_op2?IS_TMP_VAR:opline->op2.op_type), Ts ELS_CC);
+					zend_assign_to_variable(&opline->result, &opline->op1, &opline->op2, value, (free_op2?IS_TMP_VAR:opline->op2.op_type), Ts ELS_CC);
 					/* zend_assign_to_variable() always takes care of op2, never free it! */
 				}
 				break;
@@ -1466,7 +1471,7 @@ send_by_ref:
 					} else if ((*param)->is_ref) {
 						zend_assign_to_variable_reference(NULL, get_zval_ptr_ptr(&opline->result, Ts, BP_VAR_W), param, NULL ELS_CC);
 					} else {
-						zend_assign_to_variable(NULL, &opline->result, *param, IS_VAR, Ts ELS_CC);
+						zend_assign_to_variable(NULL, &opline->result, NULL, *param, IS_VAR, Ts ELS_CC);
 					}
 				}
 				break;
@@ -1505,7 +1510,7 @@ send_by_ref:
 					if (assignment_value->is_ref) {
 						zend_assign_to_variable_reference(NULL, get_zval_ptr_ptr(&opline->result, Ts, BP_VAR_W), param, NULL ELS_CC);
 					} else {
-						zend_assign_to_variable(NULL, &opline->result, assignment_value, IS_VAR, Ts ELS_CC);
+						zend_assign_to_variable(NULL, &opline->result, NULL, assignment_value, IS_VAR, Ts ELS_CC);
 					}
 				}
 				break;
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index d934225bfd..1589efdb19 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -142,8 +142,10 @@ void shutdown_executor(ELS_D)
 }
 
 
-ZEND_API char *get_active_function_name(ELS_D)
+ZEND_API char *get_active_function_name()
 {
+	ELS_FETCH();
+
 	switch(EG(function_state_ptr)->function->type) {
 		case ZEND_USER_FUNCTION: {
 				char *function_name = ((zend_op_array *) EG(function_state_ptr)->function)->function_name;