Patch bug71539.diff for Scripting Engine problem Bug #71539

Patch version 2016-07-06 10:07 UTC

Obsoleted by patches:

• bug71539.diff, revision 2016-07-06 14:33 UTC
• bug71539.diff, revision 2016-07-06 19:05 UTC
• bug71539.diff, revision 2016-07-06 20:13 UTC

Developer: dmitry@php.net

Line 1 (now 1), was 19 lines, now 17 lines

  diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
 index 03ab7d1..76827b4 100644
 index 03ab7d1..a1ec348 100644
  --- a/Zend/zend_compile.c
  +++ b/Zend/zend_compile.c
 @@ -3026,7 +3026,28 @@ void zend_compile_assign_ref(znode *result, zend_ast *ast) /* {{{ */
 @@ -3026,7 +3026,26 @@ void zend_compile_assign_ref(znode *result, zend_ast *ast) /* {{{ */
   
   	offset = zend_delayed_compile_begin();
   	zend_delayed_compile_var(&target_node, target_ast, BP_VAR_W);
  -	zend_delayed_compile_var(&source_node, source_ast, BP_VAR_W);
  +	if ((target_ast->kind == ZEND_AST_DIM
 +	  && source_ast->kind == ZEND_AST_DIM
 +	  && target_ast->child[0]->kind != ZEND_AST_DIM)
 +	  && source_ast->kind == ZEND_AST_DIM)
  +	 || (target_ast->kind == ZEND_AST_PROP
 +	  && source_ast->kind == ZEND_AST_PROP
 +	  && target_ast->child[0]->kind != ZEND_AST_PROP)) {
 +	  && source_ast->kind == ZEND_AST_PROP)) {
  +		/* Both LHS and RHS expressions may modify the same data structure,
  +		 * and the modification during RHS evaluation may dangle the pointer
  +		 * to the result of the LHS evaluation.
  +		 * Use MAKE_REF instruction to replace direct pointer with REFERENCE.