From 74228c515197c8a3bda878a077d30c9b14482eb2 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Tue, 23 Oct 2012 11:34:25 +0800
Subject: Fixed bug #63305 (zend_mm_heap corrupted with traits)

---
 NEWS                     |  3 +++
 Zend/tests/bug63305.phpt | 43 +++++++++++++++++++++++++++++++++++++++++++
 Zend/zend_compile.c      |  4 ++--
 3 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 Zend/tests/bug63305.phpt

diff --git a/NEWS b/NEWS
index a13f99dd5b..a0396154a5 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.4.9
 
+- Core:
+  . Fixed bug #63305 (zend_mm_heap corrupted with traits). (Dmitry, Laruence)
+
 - Fileinfo:
   . Fixed bug #63248 (Load multiple magic files from a directory under Windows).
     (Anatoliy)
diff --git a/Zend/tests/bug63305.phpt b/Zend/tests/bug63305.phpt
new file mode 100644
index 0000000000..4bd3a4dbeb
--- /dev/null
+++ b/Zend/tests/bug63305.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #63305 (zend_mm_heap corrupted with traits)
+--FILE--
+<?php
+new Attachment("");
+
+function __autoload($class) {
+    switch ($class) {
+    case "Attachment":
+        eval(<<<'PHP'
+class Attachment extends File {
+}
+PHP
+    );
+        break;
+    case "File":
+        eval(<<<'PHP'
+class File {
+    use TDatabaseObject {
+        TDatabaseObject::__construct as private databaseObjectConstruct;
+    }
+    public function __construct() {
+    }
+}
+PHP
+    );
+        break;
+    case "TDatabaseObject":
+        eval(<<<'PHP'
+trait TDatabaseObject {
+    public function __construct() {
+    }
+}
+PHP
+    );
+        break;
+    }
+    return TRUE;
+}
+echo "okey";
+?>
+--EXPECT--
+okey
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 303eedb6bc..4dd3eaf1ed 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3885,7 +3885,7 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
 					
 				/* if it is 0, no modifieres has been changed */
 				if (aliases[i]->modifiers) { 
-					fn_copy.common.fn_flags = aliases[i]->modifiers;
+					fn_copy.common.fn_flags = aliases[i]->modifiers | ZEND_ACC_ALIAS;
 					if (!(aliases[i]->modifiers & ZEND_ACC_PPP_MASK)) {
 						fn_copy.common.fn_flags |= ZEND_ACC_PUBLIC;
 					}
@@ -3926,7 +3926,7 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
 					&& (!aliases[i]->trait_method->ce || fn->common.scope == aliases[i]->trait_method->ce)
 					&& (aliases[i]->trait_method->mname_len == fnname_len)
 					&& (zend_binary_strcasecmp(aliases[i]->trait_method->method_name, aliases[i]->trait_method->mname_len, fn->common.function_name, fnname_len) == 0)) {
-					fn_copy.common.fn_flags = aliases[i]->modifiers;
+					fn_copy.common.fn_flags = aliases[i]->modifiers | ZEND_ACC_ALIAS;
 
 					if (!(aliases[i]->modifiers & ZEND_ACC_PPP_MASK)) {
 						fn_copy.common.fn_flags |= ZEND_ACC_PUBLIC;
-- 
cgit v1.2.1