Fixed bug #69868 (Invalid read of size 1 in zend_compile_short_circuiting)

laruence · laruence · commit c58c5e779a3e · 2015-06-18T19:53:26.000+08:00
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
@@ -5911,6 +5911,7 @@ void zend_compile_short_circuiting(znode *result, zend_ast *ast) /* {{{ */
 		return;
 	}
 
+	opline_jmpz = &CG(active_op_array)->opcodes[opnum_jmpz];
 	GET_NODE(result, opline_jmpz->result);
 
 	opline_bool = zend_emit_op(NULL, ZEND_BOOL, &right_node, NULL);

Original file line number	Diff line number	Diff line change
`@@ -5911,6 +5911,7 @@ void zend_compile_short_circuiting(znode result, zend_ast ast) /* {{{ */`
`5911`	`5911`	`return;`
`5912`	`5912`	`}`
`5913`	`5913`
	`5914`	`+ opline_jmpz = &CG(active_op_array)->opcodes[opnum_jmpz];`
`5914`	`5915`	`GET_NODE(result, opline_jmpz->result);`
`5915`	`5916`
`5916`	`5917`	`opline_bool = zend_emit_op(NULL, ZEND_BOOL, &right_node, NULL);`