Skip to content

Commit 9692e74

Browse files
cmb69cmb69
committed
Merge branch 'master' of https://git.php.net/push/php-src 
2 parents 163f51a + 5d3cf57 commit 9692e74

File tree

21 files changed

+102
-98
lines changed

21 files changed

+102
-98
lines changed

‎Zend/tests/bug69788.phpt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
--TEST--
2+
Bug #69788: Malformed script causes Uncaught EngineException in php-cgi, valgrind SIGILL
3+
--FILE--
4+
<?php [t.[]]; ?>
5+
--EXPECTF--
6+
Notice: Array to string conversion in %s on line %d
7+
8+
Notice: Use of undefined constant t - assumed 't' in %s on line %d

‎Zend/zend_object_handlers.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ ZEND_API void zend_std_write_property(zval *object, zval *member, zval *value, v
672672
if (Z_REFCOUNTED_P(value)) {
673673
if (Z_ISREF_P(value)) {
674674
/* if we assign referenced variable, we should separate it */
675-
ZVAL_DUP(&tmp, Z_REFVAL_P(value));
675+
ZVAL_COPY(&tmp, Z_REFVAL_P(value));
676676
value = &tmp;
677677
} else {
678678
Z_ADDREF_P(value);

‎Zend/zend_operators.c‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ ZEND_API void ZEND_FASTCALL convert_scalar_to_number(zval *op) /* {{{ */
209209
(op) = &(holder); \
210210
break; \
211211
case IS_OBJECT: \
212-
ZVAL_DUP(&(holder), op); \
212+
ZVAL_COPY(&(holder), op); \
213213
convert_to_long_base(&(holder), 10); \
214214
if (Z_TYPE(holder) == IS_LONG) { \
215215
(op) = &(holder); \
@@ -312,7 +312,7 @@ ZEND_API void ZEND_FASTCALL convert_to_long_base(zval *op, int base) /* {{{ */
312312
break;
313313
case IS_ARRAY:
314314
tmp = (zend_hash_num_elements(Z_ARRVAL_P(op))?1:0);
315-
zval_dtor(op);
315+
zval_ptr_dtor(op);
316316
ZVAL_LONG(op, tmp);
317317
break;
318318
case IS_OBJECT:
@@ -369,7 +369,7 @@ ZEND_API void ZEND_FASTCALL convert_to_double(zval *op) /* {{{ */
369369
break;
370370
case IS_ARRAY:
371371
tmp = (zend_hash_num_elements(Z_ARRVAL_P(op))?1:0);
372-
zval_dtor(op);
372+
zval_ptr_dtor(op);
373373
ZVAL_DOUBLE(op, tmp);
374374
break;
375375
case IS_OBJECT:
@@ -408,7 +408,7 @@ ZEND_API void ZEND_FASTCALL convert_to_null(zval *op) /* {{{ */
408408
}
409409
}
410410

411-
zval_dtor(op);
411+
zval_ptr_dtor(op);
412412
ZVAL_NULL(op);
413413
}
414414
/* }}} */
@@ -452,7 +452,7 @@ ZEND_API void ZEND_FASTCALL convert_to_boolean(zval *op) /* {{{ */
452452
break;
453453
case IS_ARRAY:
454454
tmp = (zend_hash_num_elements(Z_ARRVAL_P(op))?1:0);
455-
zval_dtor(op);
455+
zval_ptr_dtor(op);
456456
ZVAL_BOOL(op, tmp);
457457
break;
458458
case IS_OBJECT:
@@ -516,7 +516,7 @@ ZEND_API void ZEND_FASTCALL _convert_to_string(zval *op ZEND_FILE_LINE_DC) /* {{
516516
}
517517
case IS_ARRAY:
518518
zend_error(E_NOTICE, "Array to string conversion");
519-
zval_dtor(op);
519+
zval_ptr_dtor(op);
520520
ZVAL_NEW_STR(op, zend_string_init("Array", sizeof("Array")-1, 0));
521521
break;
522522
case IS_OBJECT: {
@@ -603,14 +603,10 @@ ZEND_API void ZEND_FASTCALL convert_to_object(zval *op) /* {{{ */
603603
switch (Z_TYPE_P(op)) {
604604
case IS_ARRAY:
605605
{
606-
HashTable *properties = emalloc(sizeof(HashTable));
607-
zend_array *arr = Z_ARR_P(op);
608-
609-
memcpy(properties, Z_ARRVAL_P(op), sizeof(HashTable));
610-
object_and_properties_init(op, zend_standard_class_def, properties);
611-
if (--GC_REFCOUNT(arr) == 0) {
612-
efree_size(arr, sizeof(zend_array));
613-
}
606+
zval tmp;
607+
ZVAL_COPY_VALUE(&tmp, op);
608+
SEPARATE_ARRAY(&tmp);
609+
object_and_properties_init(op, zend_standard_class_def, Z_ARR(tmp));
614610
break;
615611
}
616612
case IS_OBJECT:

‎Zend/zend_operators.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -364,7 +364,6 @@ ZEND_API void ZEND_FASTCALL zend_locale_sprintf_double(zval *op ZEND_FILE_LINE_D
364364

365365
#define convert_to_ex_master(pzv, lower_type, upper_type) \
366366
if (Z_TYPE_P(pzv)!=upper_type) { \
367-
SEPARATE_ZVAL_IF_NOT_REF(pzv); \
368367
convert_to_##lower_type(pzv); \
369368
}
370369

@@ -400,7 +399,6 @@ ZEND_API void ZEND_FASTCALL zend_locale_sprintf_double(zval *op ZEND_FILE_LINE_D
400399

401400
#define convert_to_explicit_type_ex(pzv, str_type) \
402401
if (Z_TYPE_P(pzv) != str_type) { \
403-
SEPARATE_ZVAL_IF_NOT_REF(pzv); \
404402
convert_to_explicit_type(pzv, str_type); \
405403
}
406404

@@ -414,7 +412,6 @@ ZEND_API void ZEND_FASTCALL zend_locale_sprintf_double(zval *op ZEND_FILE_LINE_D
414412

415413
#define convert_scalar_to_number_ex(pzv) \
416414
if (Z_TYPE_P(pzv)!=IS_LONG && Z_TYPE_P(pzv)!=IS_DOUBLE) { \
417-
SEPARATE_ZVAL_IF_NOT_REF(pzv); \
418415
convert_scalar_to_number(pzv); \
419416
}
420417

‎Zend/zend_vm_def.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5432,8 +5432,7 @@ ZEND_VM_HANDLER(21, ZEND_CAST, CONST|TMP|VAR|CV, ANY)
54325432
}
54335433
}
54345434
} else {
5435-
ZVAL_COPY_VALUE(result, expr);
5436-
zval_opt_copy_ctor(result);
5435+
ZVAL_COPY(result, expr);
54375436
convert_to_object(result);
54385437
}
54395438
}

‎Zend/zend_vm_execute.h‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3730,8 +3730,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CAST_SPEC_CONST_HANDLER(ZEND_O
37303730
}
37313731
}
37323732
} else {
3733-
ZVAL_COPY_VALUE(result, expr);
3734-
zval_opt_copy_ctor(result);
3733+
ZVAL_COPY(result, expr);
37353734
convert_to_object(result);
37363735
}
37373736
}
@@ -12350,8 +12349,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPC
1235012349
}
1235112350
}
1235212351
} else {
12353-
ZVAL_COPY_VALUE(result, expr);
12354-
zval_opt_copy_ctor(result);
12352+
ZVAL_COPY(result, expr);
1235512353
convert_to_object(result);
1235612354
}
1235712355
}
@@ -15827,8 +15825,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPC
1582715825
}
1582815826
}
1582915827
} else {
15830-
ZVAL_COPY_VALUE(result, expr);
15831-
zval_opt_copy_ctor(result);
15828+
ZVAL_COPY(result, expr);
1583215829
convert_to_object(result);
1583315830
}
1583415831
}
@@ -29481,8 +29478,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCO
2948129478
}
2948229479
}
2948329480
} else {
29484-
ZVAL_COPY_VALUE(result, expr);
29485-
zval_opt_copy_ctor(result);
29481+
ZVAL_COPY(result, expr);
2948629482
convert_to_object(result);
2948729483
}
2948829484
}

‎ext/gmp/gmp.c‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1837,6 +1837,7 @@ ZEND_FUNCTION(gmp_random_range)
18371837
{
18381838
zval *min_arg, *max_arg;
18391839
mpz_ptr gmpnum_min, gmpnum_max, gmpnum_result;
1840+
mpz_t gmpnum_range;
18401841
gmp_temp_t temp_a, temp_b;
18411842

18421843
if (zend_parse_parameters(ZEND_NUM_ARGS(), "zz", &min_arg, &max_arg) == FAILURE) {
@@ -1855,22 +1856,23 @@ ZEND_FUNCTION(gmp_random_range)
18551856
}
18561857

18571858
INIT_GMP_RETVAL(gmpnum_result);
1859+
mpz_init(gmpnum_range);
18581860

1859-
if (Z_LVAL_P(min_arg)) {
1860-
mpz_sub_ui(gmpnum_max, gmpnum_max, Z_LVAL_P(min_arg));
1861+
if (Z_LVAL_P(min_arg) != 0) {
1862+
mpz_sub_ui(gmpnum_range, gmpnum_max, Z_LVAL_P(min_arg) - 1);
1863+
} else {
1864+
mpz_add_ui(gmpnum_range, gmpnum_max, 1);
18611865
}
18621866

1863-
mpz_add_ui(gmpnum_max, gmpnum_max, 1);
1864-
mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_max);
1867+
mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_range);
18651868

1866-
if (Z_LVAL_P(min_arg)) {
1869+
if (Z_LVAL_P(min_arg) != 0) {
18671870
mpz_add_ui(gmpnum_result, gmpnum_result, Z_LVAL_P(min_arg));
18681871
}
18691872

1873+
mpz_clear(gmpnum_range);
18701874
FREE_GMP_TEMP(temp_a);
1871-
1872-
}
1873-
else {
1875+
} else {
18741876
FETCH_GMP_ZVAL_DEP(gmpnum_min, min_arg, temp_b, temp_a);
18751877

18761878
if (mpz_cmp(gmpnum_max, gmpnum_min) <= 0) {
@@ -1881,12 +1883,14 @@ ZEND_FUNCTION(gmp_random_range)
18811883
}
18821884

18831885
INIT_GMP_RETVAL(gmpnum_result);
1886+
mpz_init(gmpnum_range);
18841887

1885-
mpz_sub(gmpnum_max, gmpnum_max, gmpnum_min);
1886-
mpz_add_ui(gmpnum_max, gmpnum_max, 1);
1887-
mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_max);
1888+
mpz_sub(gmpnum_range, gmpnum_max, gmpnum_min);
1889+
mpz_add_ui(gmpnum_range, gmpnum_range, 1);
1890+
mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_range);
18881891
mpz_add(gmpnum_result, gmpnum_result, gmpnum_min);
18891892

1893+
mpz_clear(gmpnum_range);
18901894
FREE_GMP_TEMP(temp_b);
18911895
FREE_GMP_TEMP(temp_a);
18921896
}

‎ext/gmp/tests/bug69803.phpt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
Bug #69803: gmp_random_range() modifies second parameter if GMP number
3+
--FILE--
4+
<?php
5+
6+
$a = gmp_init(100);
7+
$b = gmp_init(200);
8+
echo $a . ", ", $b . "\n";
9+
gmp_random_range($a, $b);
10+
echo $a . ", ", $b . "\n";
11+
12+
$b = gmp_init(200);
13+
echo $a . ", ", $b . "\n";
14+
gmp_random_range(100, $b);
15+
echo $a . ", ", $b . "\n";
16+
17+
?>
18+
--EXPECT--
19+
100, 200
20+
100, 200
21+
100, 200
22+
100, 200

‎ext/gmp/tests/gmp_random_range.phpt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ gmp_random_range() basic tests
55
--FILE--
66
<?php
77

8-
$minusTen = gmp_init(-1);
9-
$plusTen = gmp_init(1);
8+
$minusTen = gmp_init(-10);
9+
$plusTen = gmp_init(10);
1010
$zero = gmp_init(0);
1111

1212
var_dump(gmp_random_range());

‎ext/iconv/iconv.c‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2209,8 +2209,8 @@ PHP_FUNCTION(iconv_mime_encode)
22092209
{
22102210
zend_string *field_name = NULL;
22112211
zend_string *field_value = NULL;
2212+
zend_string *tmp_str = NULL;
22122213
zval *pref = NULL;
2213-
zval tmp_zv, *tmp_zv_p = NULL;
22142214
smart_str retval = {0};
22152215
php_iconv_err_t err;
22162216

@@ -2273,12 +2273,8 @@ PHP_FUNCTION(iconv_mime_encode)
22732273

22742274
if ((pzval = zend_hash_str_find(Z_ARRVAL_P(pref), "line-break-chars", sizeof("line-break-chars") - 1)) != NULL) {
22752275
if (Z_TYPE_P(pzval) != IS_STRING) {
2276-
ZVAL_DUP(&tmp_zv, pzval);
2277-
convert_to_string(&tmp_zv);
2278-
2279-
lfchars = Z_STRVAL(tmp_zv);
2280-
2281-
tmp_zv_p = &tmp_zv;
2276+
tmp_str = zval_get_string(pzval);
2277+
lfchars = tmp_str->val;
22822278
} else {
22832279
lfchars = Z_STRVAL_P(pzval);
22842280
}
@@ -2301,8 +2297,8 @@ PHP_FUNCTION(iconv_mime_encode)
23012297
RETVAL_FALSE;
23022298
}
23032299

2304-
if (tmp_zv_p != NULL) {
2305-
zval_dtor(tmp_zv_p);
2300+
if (tmp_str) {
2301+
zend_string_release(tmp_str);
23062302
}
23072303
}
23082304
/* }}} */

0 commit comments

Comments
 (0)