Fixed bug #70262 (Accessing array crashes PHP 7.0beta3)

Author: dstogov

NEWS

@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 20 Aug 2015, PHP 7.0.0 RC 1
 
 - Core:
+  . Fixed bug #70262 (Accessing array crashes PHP 7.0beta3).
+    (Laruence, Dmitry)
   . Fixed bug #70258 (Segfault if do_resize fails to allocated memory).
     (Laruence)
   . Fixed bug #70253 (segfault at _efree () in zend_alloc.c:1389). (Laruence)

Zend/tests/bug70262.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug #70262 (Accessing array crashes)
+--FILE--
+<?php
+class C {
+    public $arguments;
+    public function __construct($arg) {
+        $this->arguments = $arg;
+    }
+}
+
+function & a(&$arg) {
+    $c = new C($arg);
+    $arg[] = $c;
+    return $c;
+}
+
+function c($arr) {
+    a($arr)->arguments[0] = "bad";
+}
+
+$arr = array();
+$arr[] = "foo";
+$arr[] = "bar";
+c($arr);
+var_dump($arr);
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(3) "foo"
+  [1]=>
+  string(3) "bar"
+}

Zend/zend_vm_def.h

@@ -7250,11 +7250,11 @@ ZEND_VM_HANDLER(156, ZEND_SEPARATE, VAR, UNUSED)
 	zval *var_ptr;
 
 	var_ptr = EX_VAR(opline->op1.var);
-	if (Z_TYPE_P(var_ptr) != IS_OBJECT &&
-	    !Z_ISREF_P(var_ptr) &&
-	    Z_REFCOUNTED_P(var_ptr) &&
-	    Z_REFCOUNT_P(var_ptr) > 1) {
-
+	if (UNEXPECTED(Z_ISREF_P(var_ptr))) {
+		if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) {
+			ZVAL_UNREF(var_ptr);
+		}
+	} else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) {
 		Z_DELREF_P(var_ptr);
 		ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr);
 	}

Zend/zend_vm_execute.h

@@ -19444,11 +19444,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDL
 	zval *var_ptr;
 
 	var_ptr = EX_VAR(opline->op1.var);
-	if (Z_TYPE_P(var_ptr) != IS_OBJECT &&
-	    !Z_ISREF_P(var_ptr) &&
-	    Z_REFCOUNTED_P(var_ptr) &&
-	    Z_REFCOUNT_P(var_ptr) > 1) {
-
+	if (UNEXPECTED(Z_ISREF_P(var_ptr))) {
+		if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) {
+			ZVAL_UNREF(var_ptr);
+		}
+	} else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) {
 		Z_DELREF_P(var_ptr);
 		ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr);
 	}