Patch bug72213.diff for Scripting Engine problem Bug #72213

Patch version 2016-05-16 15:37 UTC

• 2016-05-16 15:37 UTC [diff to current]

Developer: laruence@php.net

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index bb430dc..75d0f9b 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -7096,7 +7096,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 {
 	uint32_t op_num = EG(opline_before_exception) - EX(func)->op_array.opcodes;
 	int i;
-	uint32_t catch_op_num = 0, finally_op_num = 0, finally_op_end = 0;
+	uint32_t catch_op_num = 0, finally_op_num = 0, finally_op_end = 0, fast_call_num = 0;
 	int in_finally = 0;
 
 	{
@@ -7127,6 +7127,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 		if (op_num >= EX(func)->op_array.try_catch_array[i].finally_op &&
 				op_num < EX(func)->op_array.try_catch_array[i].finally_end) {
 			finally_op_end = EX(func)->op_array.try_catch_array[i].finally_end;
+			fast_call_num = finally_op_end;
 			in_finally = 1;
 		}
 	}
@@ -7137,8 +7138,12 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 		zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
 
 		cleanup_live_vars(execute_data, op_num, finally_op_num);
-		if (in_finally && Z_OBJ_P(fast_call)) {
-			zend_exception_set_previous(EG(exception), Z_OBJ_P(fast_call));
+		if (fast_call_num) {
+			zval *live_fast_call = EX_VAR(EX(func)->op_array.opcodes[fast_call_num].op1.var);
+			if (Z_OBJ_P(live_fast_call)) {
+				zend_exception_set_previous(EG(exception), Z_OBJ_P(live_fast_call));
+			}
+			Z_OBJ_P(live_fast_call) = NULL;
 		}
 		Z_OBJ_P(fast_call) = EG(exception);
 		EG(exception) = NULL;
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d729f83..af1e00c 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1693,7 +1693,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 {
 	uint32_t op_num = EG(opline_before_exception) - EX(func)->op_array.opcodes;
 	int i;
-	uint32_t catch_op_num = 0, finally_op_num = 0, finally_op_end = 0;
+	uint32_t catch_op_num = 0, finally_op_num = 0, finally_op_end = 0, fast_call_num = 0;
 	int in_finally = 0;
 
 	{
@@ -1724,6 +1724,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 		if (op_num >= EX(func)->op_array.try_catch_array[i].finally_op &&
 				op_num < EX(func)->op_array.try_catch_array[i].finally_end) {
 			finally_op_end = EX(func)->op_array.try_catch_array[i].finally_end;
+			fast_call_num = finally_op_end;
 			in_finally = 1;
 		}
 	}
@@ -1734,8 +1735,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(
 		zval *fast_call = EX_VAR(EX(func)->op_array.opcodes[finally_op_end].op1.var);
 
 		cleanup_live_vars(execute_data, op_num, finally_op_num);
-		if (in_finally && Z_OBJ_P(fast_call)) {
-			zend_exception_set_previous(EG(exception), Z_OBJ_P(fast_call));
+		if (fast_call_num) {
+			zval *live_fast_call = EX_VAR(EX(func)->op_array.opcodes[fast_call_num].op1.var);
+			if (Z_OBJ_P(live_fast_call)) {
+				zend_exception_set_previous(EG(exception), Z_OBJ_P(live_fast_call));
+			}
+			Z_OBJ_P(live_fast_call) = NULL;
 		}
 		Z_OBJ_P(fast_call) = EG(exception);
 		EG(exception) = NULL;