diff options
author | Ondřej Surý <ondrej@sury.org> | 2013-06-06 20:32:27 +0200 |
---|---|---|
committer | Ondřej Surý <ondrej@sury.org> | 2013-06-06 20:32:27 +0200 |
commit | d9b0e944a6bfa31fec6b71170346648925e76935 (patch) | |
tree | b6de5f6389aeb27758d34f29ea6f000570f5e9fc /Zend | |
parent | 4cd628b36adb52a09b58782cd60c5f4ce2ad4764 (diff) | |
download | php-d9b0e944a6bfa31fec6b71170346648925e76935.tar.gz |
New upstream version 5.5.0~rc3
Diffstat (limited to 'Zend')
-rw-r--r-- | Zend/tests/bug64960.phpt | 40 | ||||
-rw-r--r-- | Zend/zend_compile.c | 2 | ||||
-rw-r--r-- | Zend/zend_execute_API.c | 6 |
3 files changed, 43 insertions, 5 deletions
diff --git a/Zend/tests/bug64960.phpt b/Zend/tests/bug64960.phpt new file mode 100644 index 000000000..b31cca3dc --- /dev/null +++ b/Zend/tests/bug64960.phpt @@ -0,0 +1,40 @@ +--TEST-- +Bug #64960 (Segfault in gc_zval_possible_root) +--FILE-- +<?php +// this makes ob_end_clean raise an error +ob_end_flush(); + +class ExceptionHandler { + public function __invoke (Exception $e) + { + // this triggers the custom error handler + ob_end_clean(); + } +} + +// this must be a class, closure does not trigger segfault +set_exception_handler(new ExceptionHandler()); + +// exception must be throwed from error handler. +set_error_handler(function() +{ + $e = new Exception; + $e->_trace = debug_backtrace(); + + throw $e; +}); + +// trigger error handler +$a['waa']; +?> +--EXPECTF-- +Notice: ob_end_flush(): failed to delete and flush buffer. No buffer to delete or flush in %sbug64960.php on line 3 + +Fatal error: Uncaught exception 'Exception' in %sbug64960.php:19 +Stack trace: +#0 [internal function]: {closure}(8, 'ob_end_clean():...', '%s', 9, Array) +#1 %sbug64960.php(9): ob_end_clean() +#2 [internal function]: ExceptionHandler->__invoke(Object(Exception)) +#3 {main} + thrown in %sbug64960.php on line 19 diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 862f82da0..8674f9247 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -5687,7 +5687,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC) /* {{{ */ break; } SET_NODE(opline->op1, cmd); - opline->op2.opline_num = 0; + opline->op2.opline_num = 1; opline->extended_value = ZEND_DO_FCALL; SET_UNUSED(opline->op2); diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 8739e21c2..d831b107a 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -254,15 +254,13 @@ void shutdown_executor(TSRMLS_D) /* {{{ */ if (EG(user_error_handler)) { zeh = EG(user_error_handler); EG(user_error_handler) = NULL; - zval_dtor(zeh); - FREE_ZVAL(zeh); + zval_ptr_dtor(&zeh); } if (EG(user_exception_handler)) { zeh = EG(user_exception_handler); EG(user_exception_handler) = NULL; - zval_dtor(zeh); - FREE_ZVAL(zeh); + zval_ptr_dtor(&zeh); } zend_stack_destroy(&EG(user_error_handlers_error_reporting)); |