diff options
| -rw-r--r-- | Zend/tests/bug47572.phpt | 17 | ||||
| -rw-r--r-- | Zend/zend_execute_API.c | 8 |
2 files changed, 23 insertions, 2 deletions
diff --git a/Zend/tests/bug47572.phpt b/Zend/tests/bug47572.phpt new file mode 100644 index 0000000000..695cc3a7f9 --- /dev/null +++ b/Zend/tests/bug47572.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #47572 (zval_update_constant_ex: Segmentation fault) +--FILE-- +<?php + +class Foo { + public static $bar = array( + FOO => "bar" + ); + +} + +$foo = new Foo(); + +?> +--EXPECTF-- +Notice: Use of undefined constant FOO - assumed 'FOO' in %s on line %d diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 0851aa1c20..bdf20bc8a3 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -655,10 +655,12 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco str_index.u = colon.u + 1; } else { if (str_index.u[str_index_len - 2] & IS_CONSTANT_UNQUALIFIED) { - actual = (UChar *)u_memrchr(str_index.u, '\\', str_index_len - 3) + 1; + if ((actual = (UChar *)u_memrchr(str_index.u, '\\', str_index_len - 3))) { + actual++; str_index_len -= (actual - str_index.u); str_index.u = actual; } + } if (str_index.u[0] == '\\') { ++str_index.u; --str_index_len; @@ -678,10 +680,12 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco str_index.s = colon.s + 1; } else { if (str_index.s[str_index_len - 2] & IS_CONSTANT_UNQUALIFIED) { - actual = (char *)zend_memrchr(str_index.s, '\\', str_index_len - 3) + 1; + if ((actual = (char *)zend_memrchr(str_index.s, '\\', str_index_len - 3))) { + actual++; str_index_len -= (actual - str_index.s); str_index.s = actual; } + } if (str_index.s[0] == '\\') { ++str_index.s; --str_index_len; |