Fixed bug #36071 (Engine Crash related with 'clone')

dstogov · dstogov · commit 2df44321cfc7 · 2006-01-19T07:24:17.000Z
diff --git a/NEWS b/NEWS
@@ -4,6 +4,7 @@ PHP                                                                        NEWS
 - Fixed an error in mysqli_fetch_fields (returned NULL instead of an
   array when row number > field_count). (Georg)
 - Renamed CachingRecursiveIterator to RecursiveCachingIterator. (Marcus)
+- Fixed bug #36071 (Engine Crash related with 'clone'). (Dmitry)
 - Fixed bug #36006 (Problem with $this in __destruct()). (Dmitry)
 - Fixed bug #35612 (iis6 Access Violation crash). (Dmitry, alacn.uhahaa)
 - Fixed bug #35570 (segfault when re-using soap client object). (Dmitry)
diff --git a/Zend/tests/bug36071.phpt b/Zend/tests/bug36071.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #36071 (Engine Crash related with 'clone')
+--INI--
+error_reporting=4095
+--FILE--
+<?php
+$a = clone 0;
+$a[0]->b = 0;
+echo "ok\n";
+?>
+--EXPECTF--
+Warning: __clone method called on non-object in %sbug36071.php on line 2
+ok
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
@@ -371,6 +371,14 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode
 	zval *value = get_zval_ptr(value_op, Ts, &free_value, BP_VAR_R);
 	zval **retval = &T(result->u.var).var.ptr;
 
+	if (*object_ptr == EG(error_zval_ptr)) {
+		FREE_OP(Ts, op2, EG(free_op2));
+		*retval = EG(uninitialized_zval_ptr);
+		SELECTIVE_PZVAL_LOCK(*retval, result);
+		FREE_OP(Ts, value_op, free_value);
+		return;
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;
 	
