php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-17 21:11:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix a memory corruption bug with by-ref function arguments

Browse Source
This commit is contained in:
Zeev Suraski
2000-05-11 18:31:21 +00:00
parent 07f7b8c1e3
commit cb35b7e4ed
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
Zend/zend_compile.c
View File

@@ -786,16 +786,17 @@ void do_receive_arg(int op, znode *var, znode *offset, znode *initialization, un
} else {
SET_UNUSED(opline->op2);
}
if (pass_type==BYREF_FORCE && !CG(active_op_array)->arg_types) {
int i;
if (!CG(active_op_array)->arg_types) {
if (pass_type==BYREF_FORCE) {
int i;
CG(active_op_array)->arg_types = (unsigned char *) emalloc(sizeof(unsigned char)*(offset->u.constant.value.lval+1));
for (i=1; i<offset->u.constant.value.lval; i++) {
CG(active_op_array)->arg_types[i] = BYREF_NONE;
CG(active_op_array)->arg_types = (unsigned char *) emalloc(sizeof(unsigned char)*(offset->u.constant.value.lval+1));
for (i=1; i<offset->u.constant.value.lval; i++) {
CG(active_op_array)->arg_types[i] = BYREF_NONE;
}
CG(active_op_array)->arg_types[0]=(unsigned char) offset->u.constant.value.lval;
}
CG(active_op_array)->arg_types[0]=(unsigned char) offset->u.constant.value.lval;
}
if (CG(active_op_array)->arg_types) {
} else {
CG(active_op_array)->arg_types = (unsigned char *) erealloc(CG(active_op_array)->arg_types, sizeof(unsigned char)*(offset->u.constant.value.lval+1));
CG(active_op_array)->arg_types[offset->u.constant.value.lval] = pass_type;
CG(active_op_array)->arg_types[0]++;