- Fixed bug #670: Xdebug crashes with broken "break x" code.

SVN Rev: 3407
xdebug · Mar 10, 2011 · a10d193 · a10d193
1 parent 46f3f37
commit a10d193
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 2 deletions.
diff --git a/tests/bug00670.phpt b/tests/bug00670.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Test for bug #670: Xdebug crashes with broken "break x" code.
+--FILE--
+<?php
+xdebug_start_code_coverage( XDEBUG_CC_DEAD_CODE | XDEBUG_CC_UNUSED );
+include '670-ConsistentHashing.php';
+echo "OK\n";
+--EXPECT--
+OK
diff --git a/xdebug_code_coverage.c b/xdebug_code_coverage.c
@@ -338,6 +338,10 @@ static zend_brk_cont_element* xdebug_find_brk_cont(zval *nest_levels_zval, int a
 	nest_levels = nest_levels_zval->value.lval;
 
 	do {
+		if (array_offset == -1) {
+			// broken break/continue in code
+			return NULL;
+		}
 		jmp_to = &op_array->brk_cont_array[array_offset];
 		array_offset = jmp_to->parent;
 	} while (--nest_levels > 0);
@@ -376,8 +380,13 @@ static int xdebug_find_jump(zend_op_array *opa, unsigned int position, long *jmp
 #else
 			el = xdebug_find_brk_cont(&opcode.op2.u.constant, opcode.op1.u.opline_num, opa);
 #endif
-			*jmp1 = opcode.opcode == ZEND_BRK ? el->brk : el->cont;
-			return 1;
+			if (el) {
+				*jmp1 = opcode.opcode == ZEND_BRK ? el->brk : el->cont;
+				return 1;
+			} else {
+				// broken break/continue in code
+				return 0;
+			}
 		}
 	} else if (opcode.opcode == ZEND_FE_RESET || opcode.opcode == ZEND_FE_FETCH) {
 		*jmp1 = position + 1;