Patch bug62991.patch for Reproducible crash Bug #62991

Patch version 2012-09-02 09:58 UTC

Obsoleted by patches:

• bug62991.patch, revision 2012-09-02 11:45 UTC
• bug62991.patch, revision 2012-09-04 06:56 UTC

Obsolete patches:

• bug62991.patch, revision 2012-09-02 09:54 UTC

Developer: laruence@php.net

 diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
 index c7527b4..36f80b7 100644
 --- a/Zend/zend_closures.c
 +++ b/Zend/zend_closures.c
 @@ -36,7 +36,7 @@
  
  typedef struct _zend_closure {
  	zend_object    std;
 -	zend_function  func;
 +	zend_function *func;
  	zval          *this_ptr;
  	HashTable     *debug_info;
  } zend_closure;
 @@ -90,7 +90,7 @@ ZEND_METHOD(Closure, bind)
  
  	closure = (zend_closure *)zend_object_store_get_object(zclosure TSRMLS_CC);	
  
 -	if ((newthis != NULL) && (closure->func.common.fn_flags & ZEND_ACC_STATIC)) {
 +	if ((newthis != NULL) && (closure->func->common.fn_flags & ZEND_ACC_STATIC)) {
  		zend_error(E_WARNING, "Cannot bind an instance to a static closure");
  	}
  
 @@ -118,7 +118,7 @@ ZEND_METHOD(Closure, bind)
  
  			if ((class_name_len == sizeof("static") - 1) &&
  				(memcmp("static", class_name, sizeof("static") - 1) == 0)) {
 -				ce = closure->func.common.scope;
 +				ce = closure->func->common.scope;
  			}
  			else if (zend_lookup_class_ex(class_name, class_name_len, NULL, 1, &ce_p TSRMLS_CC) == FAILURE) {
  				zend_error(E_WARNING, "Class '%s' not found", class_name);
 @@ -130,10 +130,10 @@ ZEND_METHOD(Closure, bind)
  			zval_dtor(&tmp_zval);
  		}
  	} else { /* scope argument not given; do not change the scope by default */
 -		ce = closure->func.common.scope;
 +		ce = closure->func->common.scope;
  	}
  
 -	zend_create_closure(return_value, &closure->func, ce, newthis TSRMLS_CC);
 +	zend_create_closure(return_value, closure->func, ce, newthis TSRMLS_CC);
  }
  /* }}} */
  
 @@ -155,9 +155,9 @@ ZEND_API zend_function *zend_get_closure_invoke_method(zval *obj TSRMLS_DC) /* {
  	zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);	
  	zend_function *invoke = (zend_function*)emalloc(sizeof(zend_function));
  
 -	invoke->common = closure->func.common;
 +	invoke->common = closure->func->common;
  	invoke->type = ZEND_INTERNAL_FUNCTION;
 -	invoke->internal_function.fn_flags = ZEND_ACC_PUBLIC | ZEND_ACC_CALL_VIA_HANDLER | (closure->func.common.fn_flags & ZEND_ACC_RETURN_REFERENCE);
 +	invoke->internal_function.fn_flags = ZEND_ACC_PUBLIC | ZEND_ACC_CALL_VIA_HANDLER | (closure->func->common.fn_flags & ZEND_ACC_RETURN_REFERENCE);
  	invoke->internal_function.handler = ZEND_MN(Closure___invoke);
  	invoke->internal_function.module = 0;
  	invoke->internal_function.scope = zend_ce_closure;
 @@ -169,7 +169,7 @@ ZEND_API zend_function *zend_get_closure_invoke_method(zval *obj TSRMLS_DC) /* {
  ZEND_API const zend_function *zend_get_closure_method_def(zval *obj TSRMLS_DC) /* {{{ */
  {
  	zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);	
 -	return &closure->func;
 +	return closure->func;
  }
  /* }}} */
  
 @@ -240,15 +240,18 @@ static void zend_closure_free_storage(void *object TSRMLS_DC) /* {{{ */
  
  	zend_object_std_dtor(&closure->std TSRMLS_CC);
  
 -	if (closure->func.type == ZEND_USER_FUNCTION) {
 +	if (closure->func->type == ZEND_USER_FUNCTION) {
  		zend_execute_data *ex = EG(current_execute_data);
  		while (ex) {
 -			if (ex->op_array == &closure->func.op_array) {
 +			if (ex->op_array == &closure->func->op_array) {
  				zend_error(E_ERROR, "Cannot destroy active lambda function");
  			}
  			ex = ex->prev_execute_data;
  		}
 -		destroy_op_array(&closure->func.op_array TSRMLS_CC);
 +		if (!(closure->func->common.fn_flags & ZEND_ACC_GENERATOR)) {
 +			destroy_op_array(&closure->func->op_array TSRMLS_CC);
 +			efree(closure->func);
 +		}
  	}
  
  	if (closure->debug_info != NULL) {
 @@ -286,12 +289,11 @@ static zend_object_value zend_closure_clone(zval *zobject TSRMLS_DC) /* {{{ */
  	zend_closure *closure = (zend_closure *)zend_object_store_get_object(zobject TSRMLS_CC);
  	zval result;
  
 -	zend_create_closure(&result, &closure->func, closure->func.common.scope, closure->this_ptr TSRMLS_CC);
 +	zend_create_closure(&result, closure->func, closure->func->common.scope, closure->this_ptr TSRMLS_CC);
  	return Z_OBJVAL(result);
  }
  /* }}} */
  
 -
  int zend_closure_get_closure(zval *obj, zend_class_entry **ce_ptr, zend_function **fptr_ptr, zval **zobj_ptr TSRMLS_DC) /* {{{ */
  {
  	zend_closure *closure;
 @@ -301,7 +303,7 @@ int zend_closure_get_closure(zval *obj, zend_class_entry **ce_ptr, zend_function
  	}
  
  	closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
 -	*fptr_ptr = &closure->func;
 +	*fptr_ptr = closure->func;
  
  	if (closure->this_ptr) {
  		if (zobj_ptr) {
 @@ -312,7 +314,7 @@ int zend_closure_get_closure(zval *obj, zend_class_entry **ce_ptr, zend_function
  		if (zobj_ptr) {
  			*zobj_ptr = NULL;
  		}
 -		*ce_ptr = closure->func.common.scope;
 +		*ce_ptr = closure->func->common.scope;
  	}
  	return SUCCESS;
  }
 @@ -322,7 +324,7 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp TSRMLS_
  {
  	zend_closure *closure = (zend_closure *)zend_object_store_get_object(object TSRMLS_CC);
  	zval *val;
 -	struct _zend_arg_info *arg_info = closure->func.common.arg_info;
 +	struct _zend_arg_info *arg_info = closure->func->common.arg_info;
  
  	*is_temp = 0;
  
 @@ -331,8 +333,8 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp TSRMLS_
  		zend_hash_init(closure->debug_info, 1, NULL, ZVAL_PTR_DTOR, 0);
  	}
  	if (closure->debug_info->nApplyCount == 0) {
 -		if (closure->func.type == ZEND_USER_FUNCTION && closure->func.op_array.static_variables) {
 -			HashTable *static_variables = closure->func.op_array.static_variables;
 +		if (closure->func->type == ZEND_USER_FUNCTION && closure->func->op_array.static_variables) {
 +			HashTable *static_variables = closure->func->op_array.static_variables;
  			MAKE_STD_ZVAL(val);
  			array_init(val);
  			zend_hash_copy(Z_ARRVAL_P(val), static_variables, (copy_ctor_func_t)zval_add_ref, NULL, sizeof(zval*));
 @@ -345,25 +347,25 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp TSRMLS_
  		}
  
  		if (arg_info) {
 -			zend_uint i, required = closure->func.common.required_num_args;
 +			zend_uint i, required = closure->func->common.required_num_args;
  
  			MAKE_STD_ZVAL(val);
  			array_init(val);
  
 -			for (i = 0; i < closure->func.common.num_args; i++) {
 +			for (i = 0; i < closure->func->common.num_args; i++) {
  				char *name, *info;
  				int name_len, info_len;
  				if (arg_info->name) {
  					name_len = zend_spprintf(&name, 0, "%s$%s",
 -									arg_info->pass_by_reference ? "&" : "",
 -									arg_info->name);
 +							arg_info->pass_by_reference ? "&" : "",
 +							arg_info->name);
  				} else {
  					name_len = zend_spprintf(&name, 0, "%s$param%d",
 -									arg_info->pass_by_reference ? "&" : "",
 -									i + 1);
 +							arg_info->pass_by_reference ? "&" : "",
 +							i + 1);
  				}
  				info_len = zend_spprintf(&info, 0, "%s",
 -								i >= required ? "<optional>" : "<required>");
 +						i >= required ? "<optional>" : "<required>");
  				add_assoc_stringl_ex(val, name, name_len + 1, info, info_len, 0);
  				efree(name);
  				arg_info++;
 @@ -382,8 +384,8 @@ static HashTable *zend_closure_get_gc(zval *obj, zval ***table, int *n TSRMLS_DC
  
  	*table = closure->this_ptr ? &closure->this_ptr : NULL;
  	*n = closure->this_ptr ? 1 : 0;
 -	return (closure->func.type == ZEND_USER_FUNCTION) ?
 -		closure->func.op_array.static_variables : NULL;
 +	return (closure->func->type == ZEND_USER_FUNCTION) ?
 +		closure->func->op_array.static_variables : NULL;
  }
  /* }}} */
  
 @@ -395,23 +397,23 @@ ZEND_METHOD(Closure, __construct)
  }
  /* }}} */
  
 -ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bindto, 0, 0, 1)
 +	ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bindto, 0, 0, 1)
  	ZEND_ARG_INFO(0, newthis)
  	ZEND_ARG_INFO(0, newscope)
  ZEND_END_ARG_INFO()
  
 -ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bind, 0, 0, 2)
 +	ZEND_BEGIN_ARG_INFO_EX(arginfo_closure_bind, 0, 0, 2)
  	ZEND_ARG_INFO(0, closure)
  	ZEND_ARG_INFO(0, newthis)
  	ZEND_ARG_INFO(0, newscope)
  ZEND_END_ARG_INFO()
  
 -static const zend_function_entry closure_functions[] = {
 -	ZEND_ME(Closure, __construct, NULL, ZEND_ACC_PRIVATE)
 -	ZEND_ME(Closure, bind, arginfo_closure_bind, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 -	ZEND_MALIAS(Closure, bindTo, bind, arginfo_closure_bindto, ZEND_ACC_PUBLIC)
 -	{NULL, NULL, NULL}
 -};
 +	static const zend_function_entry closure_functions[] = {
 +		ZEND_ME(Closure, __construct, NULL, ZEND_ACC_PRIVATE)
 +			ZEND_ME(Closure, bind, arginfo_closure_bind, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 +			ZEND_MALIAS(Closure, bindTo, bind, arginfo_closure_bindto, ZEND_ACC_PUBLIC)
 +			{NULL, NULL, NULL}
 +	};
  
  void zend_register_closure_ce(TSRMLS_D) /* {{{ */
  {
 @@ -448,8 +450,9 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
  
  	closure = (zend_closure *)zend_object_store_get_object(res TSRMLS_CC);
  
 -	closure->func = *func;
 -	closure->func.common.prototype = NULL;
 +	closure->func = emalloc(sizeof(zend_function));
 +	*closure->func = *func;
 +	closure->func->common.prototype = NULL;
  
  	if ((scope == NULL) && (this_ptr != NULL)) {
  		/* use dummy scope if we're binding an object without specifying a scope */
 @@ -457,16 +460,16 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
  		scope = zend_ce_closure;
  	}
  
 -	if (closure->func.type == ZEND_USER_FUNCTION) {
 -		if (closure->func.op_array.static_variables) {
 -			HashTable *static_variables = closure->func.op_array.static_variables;
 +	if (closure->func->type == ZEND_USER_FUNCTION) {
 +		if (closure->func->op_array.static_variables) {
 +			HashTable *static_variables = closure->func->op_array.static_variables;
  
 -			ALLOC_HASHTABLE(closure->func.op_array.static_variables);
 -			zend_hash_init(closure->func.op_array.static_variables, zend_hash_num_elements(static_variables), NULL, ZVAL_PTR_DTOR, 0);
 -			zend_hash_apply_with_arguments(static_variables TSRMLS_CC, (apply_func_args_t)zval_copy_static_var, 1, closure->func.op_array.static_variables);
 +			ALLOC_HASHTABLE(closure->func->op_array.static_variables);
 +			zend_hash_init(closure->func->op_array.static_variables, zend_hash_num_elements(static_variables), NULL, ZVAL_PTR_DTOR, 0);
 +			zend_hash_apply_with_arguments(static_variables TSRMLS_CC, (apply_func_args_t)zval_copy_static_var, 1, closure->func->op_array.static_variables);
  		}
 -		closure->func.op_array.run_time_cache = NULL;
 -		(*closure->func.op_array.refcount)++;
 +		closure->func->op_array.run_time_cache = NULL;
 +		(*closure->func->op_array.refcount)++;
  	} else {
  		/* verify that we aren't binding internal function to a wrong scope */
  		if(func->common.scope != NULL) {
 @@ -475,7 +478,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
  				scope = NULL;
  			}
  			if(scope && this_ptr && (func->common.fn_flags & ZEND_ACC_STATIC) == 0 && 
 -					!instanceof_function(Z_OBJCE_P(this_ptr), closure->func.common.scope TSRMLS_CC)) {
 +					!instanceof_function(Z_OBJCE_P(this_ptr), closure->func->common.scope TSRMLS_CC)) {
  				zend_error(E_WARNING, "Cannot bind function %s::%s to object of class %s", func->common.scope->name, func->common.function_name, Z_OBJCE_P(this_ptr)->name);
  				scope = NULL;
  				this_ptr = NULL;
 @@ -490,14 +493,14 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
  	/* Invariants:
  	 * If the closure is unscoped, it has no bound object.
  	 * The the closure is scoped, it's either static or it's bound */
 -	closure->func.common.scope = scope;
 +	closure->func->common.scope = scope;
  	if (scope) {
 -		closure->func.common.fn_flags |= ZEND_ACC_PUBLIC;
 -		if (this_ptr && (closure->func.common.fn_flags & ZEND_ACC_STATIC) == 0) {
 +		closure->func->common.fn_flags |= ZEND_ACC_PUBLIC;
 +		if (this_ptr && (closure->func->common.fn_flags & ZEND_ACC_STATIC) == 0) {
  			closure->this_ptr = this_ptr;
  			Z_ADDREF_P(this_ptr);
  		} else {
 -			closure->func.common.fn_flags |= ZEND_ACC_STATIC;
 +			closure->func->common.fn_flags |= ZEND_ACC_STATIC;
  			closure->this_ptr = NULL;
  		}
  	} else {
  diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c
 index c22d745..6f6dde6 100644
 index c22d745..35f0898 100644
  --- a/Zend/zend_generators.c
  +++ b/Zend/zend_generators.c
 @@ -154,6 +154,12 @@ void zend_generator_close(zend_generator *generator, zend_bool finished_executio
 @@ -154,6 +154,10 @@ void zend_generator_close(zend_generator *generator, zend_bool finished_executio
   			efree(prev_execute_data);
   		}
   
 +		/* Free a clone of closure */
 +		if (op_array->fn_flags & ZEND_ACC_CLOSURE) {
 +			destroy_op_array(op_array TSRMLS_CC);
 +			efree(op_array);
 +		if (execute_data->op_array->fn_flags & ZEND_ACC_CLOSURE) {
 +			destroy_op_array(execute_data->op_array);
 +			efree(execute_data->op_array);
  +		}
 +
   		efree(execute_data);
   		generator->execute_data = NULL;
   	}
 @@ -358,6 +364,14 @@ zval *zend_generator_create_zval(zend_op_array *op_array TSRMLS_DC) /* {{{ */
  	zval *return_value;
  	zend_generator *generator;
  
 +	/* Create a clone of closure, because it may be destroied */
 +	if (op_array->fn_flags & ZEND_ACC_CLOSURE) {
 +		zend_op_array *op_array_copy = (zend_op_array*)emalloc(sizeof(zend_op_array));
 +		*op_array_copy = *op_array;
 +		function_add_ref(op_array_copy);
 +		op_array = op_array_copy;
 +	}
 +	
  	/* Create new execution context. We have to back up and restore
  	 * EG(current_execute_data) and EG(opline_ptr) here because the function
  	 * modifies it. */