Edit report at https://bugs.php.net/bug.php?id=65821&edit=1
ID: 65821
Updated by: dmi...@php.net
Reported by: ni...@php.net
Summary: By-ref foreach on property access of string offset
segfaults
Status: Assigned
Type: Bug
Package: Scripting Engine problem
PHP Version: 5.5.4
-Assigned To: dmitry
+Assigned To: nikic
Block user comment: N
Private report: N
New Comment:
Nikita, I think you are right, and ZEND_FETCH_ADD_LOCK may be removed, because
now the situation that it handled resolved by the code at the end of the
handler, anyway.
I mean the situation when array might be destroyed right in ZEND_FETCH_OBJ_W
handler and EX_T(opline->result.var).var.ptr_ptr would be incorrect. e.g.
<?php
function foo() {
return array((object)array('x'=>array('a','b','c')));
}
foreach (foo()[0]->x as &$x) {
echo "$x\n";
}
?>
Now it must be handled by:
if (OP1_TYPE == IS_VAR && OP1_FREE && READY_TO_DESTROY(free_op1.var)) {
EXTRACT_ZVAL_PTR(&EX_T(opline->result.var));
}
So, your patch looks fine (I hope I didn't miss anything important)
Fell free to commit it into PHP-5.5 and above.
Please, also check if we need to set "opline->extended_value = 1" for
ZEND_FREE/ZEND_SWITCH_FREE opcodes in generate_free_foreach_copy().
I think we don't need it anymore as well.
Previous Comments:
------------------------------------------------------------------------
[2013-10-02 21:27:52] ni...@php.net
@dmity: Could you please take a look whether the ZEND_FETCH_ADD_LOCK in foreach
[1] is still necessary? I tried removing it [2] and I didn't get any test
failures in Zend/ or tests/, so maybe this is just a leftover?
[1]: http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_compile.c#6237
[2]: https://gist.github.com/nikic/6800754
------------------------------------------------------------------------
[2013-10-02 21:23:54] ni...@php.net
Description:
------------
This segfaults:
$str = "foo";
foreach ($str[0]->bar as &$baz) {}
Because http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_vm_def.h#1391 uses
var.ptr_ptr without NULL check (FETCH_OBJ_W with ZEND_FETCH_ADD_LOCK).
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=65821&edit=1
