Fixed bug #36303 (foreach on error_zval produces segfault)

php · Feb 6, 2006 · 05703d7 · 05703d7
1 parent 6195ce8
commit 05703d7
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -4,6 +4,7 @@ PHP                                                                        NEWS
 - Fixed an error in mysqli_fetch_fields (returned NULL instead of an
   array when row number > field_count). (Georg)
 - Renamed CachingRecursiveIterator to RecursiveCachingIterator. (Marcus)
+- Fixed bug #36303 (foreach on error_zval produces segfault). (Dmitry)
 - Fixed bug #36071 (Engine Crash related with 'clone'). (Dmitry)
 - Fixed bug #36006 (Problem with $this in __destruct()). (Dmitry)
 - Fixed bug #35612 (iis6 Access Violation crash). (Dmitry, alacn.uhahaa)

diff --git a/Zend/tests/bug36303.phpt b/Zend/tests/bug36303.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #36303 (foreach on error_zval produces segfault)
+--FILE--
+<?php
+$x="test";
+foreach($x->a->b as &$v) {
+}
+echo "ok\n";
+?>
+--EXPECTF--
+Warning: Invalid argument supplied for foreach() in %sbug36303.php on line 3
+ok
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
@@ -3815,7 +3815,9 @@ int zend_fe_reset_handler(ZEND_OPCODE_HANDLER_ARGS)
 			}
 			array_ptr = *array_ptr_ptr;
 		} else {
-			SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+			if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
+				SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+			}
 			array_ptr = *array_ptr_ptr;
 			array_ptr->refcount++;
 		}