cvs: ZendEngine2(PHP_5_0) / zend_execute.c /tests bug32660.phpt php-src NEWS

dmitry          Thu Jun 23 07:04:59 2005 EDT

  Added files:                 (Branch: PHP_5_0)
    /ZendEngine2/tests  bug32660.phpt 

  Modified files:              
    /php-src    NEWS 
    /ZendEngine2        zend_execute.c 
  Log:
  Fixed bug #32660 (Assignment by reference causes crash when field access is 
overloaded (__get))
  
  
http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1760.2.440&r2=1.1760.2.441&ty=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.1760.2.440 php-src/NEWS:1.1760.2.441
--- php-src/NEWS:1.1760.2.440   Thu Jun 23 05:23:02 2005
+++ php-src/NEWS        Thu Jun 23 07:04:54 2005
@@ -85,6 +85,8 @@
 - Fixed bug #32682 (ext/mssql: Error on module shutdown when called from
   activescript). (Frank)
 - Fixed bug #32674 (exception in iterator causes crash). (Dmitry)
+- Fixed bug #32660 (Assignment by reference causes crash when field access is
+  overloaded (__get)). (Dmitry)
 - Fixed bug #32647 (Using register_shutdown_function() with invalid callback
   can crash PHP). (Jani)
 - Fixed bug #32615 (Segfault in replaceChild() using fragment when 
http://cvs.php.net/diff.php/ZendEngine2/zend_execute.c?r1=1.652.2.39&r2=1.652.2.40&ty=u
Index: ZendEngine2/zend_execute.c
diff -u ZendEngine2/zend_execute.c:1.652.2.39 
ZendEngine2/zend_execute.c:1.652.2.40
--- ZendEngine2/zend_execute.c:1.652.2.39       Wed Jun 22 04:30:58 2005
+++ ZendEngine2/zend_execute.c  Thu Jun 23 07:04:55 2005
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_execute.c,v 1.652.2.39 2005/06/22 08:30:58 dmitry Exp $ */
+/* $Id: zend_execute.c,v 1.652.2.40 2005/06/23 11:04:55 dmitry Exp $ */
 
 #define ZEND_INTENSIVE_DEBUGGING 0
 
@@ -2261,12 +2261,15 @@
 
        if (opline->op2.op_type == IS_VAR &&
            !(*value_ptr_ptr)->is_ref &&
-           opline->extended_value == ZEND_RETURNS_FUNCTION && 
-           !EX_T(opline->op2.u.var).var.fcall_returned_reference) {
+            opline->extended_value == ZEND_RETURNS_FUNCTION && 
+            !EX_T(opline->op2.u.var).var.fcall_returned_reference) {
                PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of 
get_zval_ptr_ptr() */
                zend_error(E_STRICT, "Only variables should be assigned by 
reference");
                return zend_assign_handler(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
        }
+       if (opline->op1.op_type == IS_VAR && 
EX_T(opline->op1.u.var).var.ptr_ptr == &EX_T(opline->op1.u.var).var.ptr) {
+               zend_error(E_ERROR, "Cannot assign by reference to overloaded 
object");
+       }
 
        zend_assign_to_variable_reference(&opline->result, 
get_zval_ptr_ptr(&opline->op1, EX(Ts), BP_VAR_W), value_ptr_ptr, EX(Ts) 
TSRMLS_CC);
 

http://cvs.php.net/co.php/ZendEngine2/tests/bug32660.phpt?r=1.1&p=1
Index: ZendEngine2/tests/bug32660.phpt
+++ ZendEngine2/tests/bug32660.phpt
--TEST--
Bug #32660 Assignment by reference causes crash when field access is overloaded 
(__get) 
--FILE--
<?php
class A
{
        public $q;

        function __construct()
        {
                $this->q = 3;//array();
        }

        function __get($name)
        {
                return $this->q;
        }
}

$a = new A;

$b = "short";
$c =& $a->whatever;
$c = "long";
print_r($a);
$a->whatever =& $b;
$b = "much longer";
print_r($a);
?>
--EXPECTF--
A Object
(
    [q] => long
)

Fatal error: Cannot assign by reference to overloaded object in %sbug32660.php 
on line 23

-- 
Zend Engine CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php