Fixed bug #36303 (foreach on error_zval produces segfault)

dstogov · dstogov · commit 05703d7c1e7f · 2006-02-06T15:31:28.000Z
diff --git a/NEWS b/NEWS
@@ -4,6 +4,7 @@ PHP                                                                        NEWS
 - Fixed an error in mysqli_fetch_fields (returned NULL instead of an
   array when row number > field_count). (Georg)
 - Renamed CachingRecursiveIterator to RecursiveCachingIterator. (Marcus)
+- Fixed bug #36303 (foreach on error_zval produces segfault). (Dmitry)
 - Fixed bug #36071 (Engine Crash related with 'clone'). (Dmitry)
 - Fixed bug #36006 (Problem with $this in __destruct()). (Dmitry)
 - Fixed bug #35612 (iis6 Access Violation crash). (Dmitry, alacn.uhahaa)
diff --git a/Zend/tests/bug36303.phpt b/Zend/tests/bug36303.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #36303 (foreach on error_zval produces segfault)
+--FILE--
+<?php
+$x="test";
+foreach($x->a->b as &$v) {
+}
+echo "ok\n";
+?>
+--EXPECTF--
+Warning: Invalid argument supplied for foreach() in %sbug36303.php on line 3
+ok
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
@@ -3815,7 +3815,9 @@ int zend_fe_reset_handler(ZEND_OPCODE_HANDLER_ARGS)
 			}
 			array_ptr = *array_ptr_ptr;
 		} else {
-			SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
+				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+			}
 			array_ptr = *array_ptr_ptr;
 			array_ptr->refcount++;
 		}

Original file line number	Diff line number	Diff line change
`@@ -3815,7 +3815,9 @@ int zend_fe_reset_handler(ZEND_OPCODE_HANDLER_ARGS)`
`3815`	`3815`	`}`
`3816`	`3816`	`array_ptr = *array_ptr_ptr;`
`3817`	`3817`	`} else {`
`3818`		`- SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);`
	`3818`	`+ if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {`
	`3819`	`+ SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);`
	`3820`	`+ }`
`3819`	`3821`	`array_ptr = *array_ptr_ptr;`
`3820`	`3822`	`array_ptr->refcount++;`
`3821`	`3823`	`}`