Patch bug62991.patch for Reproducible crash Bug #62991

Patch version 2012-09-02 09:58 UTC

Obsoleted by patches:

• bug62991.patch, revision 2012-09-02 11:45 UTC
• bug62991.patch, revision 2012-09-04 06:56 UTC

Obsolete patches:

• bug62991.patch, revision 2012-09-02 09:54 UTC

Developer: laruence@php.net

  diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
 index c7527b4..bfc9857 100644
 index c7527b4..36f80b7 100644
  --- a/Zend/zend_closures.c
  +++ b/Zend/zend_closures.c
  @@ -36,7 +36,7 @@
   


   			}
   			ex = ex->prev_execute_data;
   		}
  -		destroy_op_array(&closure->func.op_array TSRMLS_CC);
 +        if (!(closure->func->common.fn_flags & ZEND_ACC_GENERATOR)) {
 +            destroy_op_array(&closure->func->op_array TSRMLS_CC);
 +            efree(closure->func);
 +        }
 +		if (!(closure->func->common.fn_flags & ZEND_ACC_GENERATOR)) {
 +			destroy_op_array(&closure->func->op_array TSRMLS_CC);
 +			efree(closure->func);
 +		}
   	}
   
   	if (closure->debug_info != NULL) {
  @@ -286,12 +289,11 @@ static zend_object_value zend_closure_clone(zval *zobject TSRMLS_DC) /* {{{ */


  +			HashTable *static_variables = closure->func->op_array.static_variables;
   			MAKE_STD_ZVAL(val);
   			array_init(val);
   			zend_hash_copy(Z_ARRVAL_P(val), static_variables, (copy_ctor_func_t)zval_add_ref, NULL, sizeof(zval*));
 @@ -345,12 +347,12 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp TSRMLS_
 @@ -345,25 +347,25 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp TSRMLS_
   		}
   
   		if (arg_info) {
  -			zend_uint i, required = closure->func.common.required_num_args;


  +			for (i = 0; i < closure->func->common.num_args; i++) {
   				char *name, *info;
   				int name_len, info_len;
   				if (arg_info->name) {
  					name_len = zend_spprintf(&name, 0, "%s$%s",
 -									arg_info->pass_by_reference ? "&" : "",
 -									arg_info->name);
 +							arg_info->pass_by_reference ? "&" : "",
 +							arg_info->name);
  				} else {
  					name_len = zend_spprintf(&name, 0, "%s$param%d",
 -									arg_info->pass_by_reference ? "&" : "",
 -									i + 1);
 +							arg_info->pass_by_reference ? "&" : "",
 +							i + 1);
  				}
  				info_len = zend_spprintf(&info, 0, "%s",
 -								i >= required ? "<optional>" : "<required>");
 +						i >= required ? "<optional>" : "<required>");
  				add_assoc_stringl_ex(val, name, name_len + 1, info, info_len, 0);
  				efree(name);
  				arg_info++;
  @@ -382,8 +384,8 @@ static HashTable *zend_closure_get_gc(zval *obj, zval ***table, int *n TSRMLS_DC
   
   	*table = closure->this_ptr ? &closure->this_ptr : NULL;
   	*n = closure->this_ptr ? 1 : 0;


  +		closure->func->op_array.static_variables : NULL;
   }
   /* }}} */
   
 @@ -395,23 +397,23 @@ ZEND_METHOD(Closure, __construct)
  }
  /* }}} */
  
 -ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bindto, 0, 0, 1)
 +	ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bindto, 0, 0, 1)
  	ZEND_ARG_INFO(0, newthis)
  	ZEND_ARG_INFO(0, newscope)
  ZEND_END_ARG_INFO()
  
 -ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bind, 0, 0, 2)
 +	ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bind, 0, 0, 2)
  	ZEND_ARG_INFO(0, closure)
  	ZEND_ARG_INFO(0, newthis)
  	ZEND_ARG_INFO(0, newscope)
  ZEND_END_ARG_INFO()
  
 -static const zend_function_entry closure_functions[] = {
 -	ZEND_ME(Closure, __construct, NULL, ZEND_ACC_PRIVATE)
 -	ZEND_ME(Closure, bind, arginfo_closure_bind, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 -	ZEND_MALIAS(Closure, bindTo, bind, arginfo_closure_bindto, ZEND_ACC_PUBLIC)
 -	{NULL, NULL, NULL}
 -};
 +	static const zend_function_entry closure_functions[] = {
 +		ZEND_ME(Closure, __construct, NULL, ZEND_ACC_PRIVATE)
 +			ZEND_ME(Closure, bind, arginfo_closure_bind, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 +			ZEND_MALIAS(Closure, bindTo, bind, arginfo_closure_bindto, ZEND_ACC_PUBLIC)
 +			{NULL, NULL, NULL}
 +	};
  
  void zend_register_closure_ce(TSRMLS_D) /* {{{ */
  {
  @@ -448,8 +450,9 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
   
   	closure = (zend_closure *)zend_object_store_get_object(res TSRMLS_CC);
   
  -	closure->func = *func;
  -	closure->func.common.prototype = NULL;
  +	closure->func = emalloc(sizeof(zend_function));
 +    *closure->func = *func;
 +	*closure->func = *func;
  +	closure->func->common.prototype = NULL;
   
   	if ((scope == NULL) && (this_ptr != NULL)) {
   		/* use dummy scope if we're binding an object without specifying a scope */


   			closure->this_ptr = NULL;
   		}
   	} else {
  diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c
 index c22d745..bcd19b2 100644
 index c22d745..35f0898 100644
  --- a/Zend/zend_generators.c
  +++ b/Zend/zend_generators.c
  @@ -154,6 +154,10 @@ void zend_generator_close(zend_generator *generator, zend_bool finished_executio
   			efree(prev_execute_data);
   		}
   
 +        if (execute_data->op_array->fn_flags & ZEND_ACC_CLOSURE) {
 +            destroy_op_array(execute_data->op_array);
 +            efree(execute_data->op_array);
 +        }
 +		if (execute_data->op_array->fn_flags & ZEND_ACC_CLOSURE) {
 +			destroy_op_array(execute_data->op_array);
 +			efree(execute_data->op_array);
 +		}
   		efree(execute_data);
   		generator->execute_data = NULL;
   	}