diff options
| -rw-r--r-- | NEWS | 1 | ||||
| -rwxr-xr-x | Zend/tests/bug36303.phpt | 12 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 4 |
3 files changed, 16 insertions, 1 deletions
@@ -4,6 +4,7 @@ PHP NEWS - Fixed an error in mysqli_fetch_fields (returned NULL instead of an array when row number > field_count). (Georg) - Renamed CachingRecursiveIterator to RecursiveCachingIterator. (Marcus) +- Fixed bug #36303 (foreach on error_zval produces segfault). (Dmitry) - Fixed bug #36071 (Engine Crash related with 'clone'). (Dmitry) - Fixed bug #36006 (Problem with $this in __destruct()). (Dmitry) - Fixed bug #35612 (iis6 Access Violation crash). (Dmitry, alacn.uhahaa) diff --git a/Zend/tests/bug36303.phpt b/Zend/tests/bug36303.phpt new file mode 100755 index 0000000000..612022ad56 --- /dev/null +++ b/Zend/tests/bug36303.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #36303 (foreach on error_zval produces segfault) +--FILE-- +<?php +$x="test"; +foreach($x->a->b as &$v) { +} +echo "ok\n"; +?> +--EXPECTF-- +Warning: Invalid argument supplied for foreach() in %sbug36303.php on line 3 +ok diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index f41f5ca594..d93e7dfa35 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -3815,7 +3815,9 @@ int zend_fe_reset_handler(ZEND_OPCODE_HANDLER_ARGS) } array_ptr = *array_ptr_ptr; } else { - SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr); + if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) { + SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr); + } array_ptr = *array_ptr_ptr; array_ptr->refcount++; } |