diff options
| author | Andi Gutmans <andi@php.net> | 2001-04-20 07:09:22 +0000 |
|---|---|---|
| committer | Andi Gutmans <andi@php.net> | 2001-04-20 07:09:22 +0000 |
| commit | 90cf65411c6830b7affd5a51636fcb2771aa6709 (patch) | |
| tree | 823f6c93a826e30bfa192b8e55b456514ab48446 /Zend/zend_execute.c | |
| parent | fb39bdaaf0555f107b6a8f2013f0b77599a20750 (diff) | |
| download | php-git-90cf65411c6830b7affd5a51636fcb2771aa6709.tar.gz | |
- Fix for crash bug when using invalid arguments in the foreach() loop.
- Reported by Yasuo Ohgaki
Diffstat (limited to 'Zend/zend_execute.c')
| -rw-r--r-- | Zend/zend_execute.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 23929bf286..3cca945669 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -2141,9 +2141,13 @@ send_by_ref: if (opline->extended_value) { array_ptr_ptr = get_zval_ptr_ptr(&opline->op1, Ts, BP_VAR_R); - SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr); - array_ptr = *array_ptr_ptr; - array_ptr->refcount++; + if (array_ptr_ptr == NULL) { + MAKE_STD_ZVAL(array_ptr); + } else { + SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr); + array_ptr = *array_ptr_ptr; + array_ptr->refcount++; + } } else { array_ptr = get_zval_ptr(&opline->op1, Ts, &EG(free_op1), BP_VAR_R); if (EG(free_op1)) { /* IS_TMP_VAR */ |