php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-05 07:02:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #62653: (unset($array[$float]) causes a crash)

Browse Source 
the reason why jpauli and I can not reproduce is (it's silly):
I typo "USE_ZEND_ALLOC *&&* valgrind" at the first time, then I always ctrl+r
and jpauli copied my command from the pastbin :)

thanks
This commit is contained in:
Xinchen Hui
2012-07-26 13:52:42 +08:00
parent ba27e0888a
commit eae0610042
4 changed files with 61 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -5,6 +5,8 @@ PHP NEWS
- Core:
. Fixed bug #62661 (Interactive php-cli crashes if include() is used in
auto_prepend_file). (Laruence)
. Fixed bug #62653: (unset($array[$float]) causes a crash). (Nikita Popov,
Laruence)
. Fixed bug #62565 (Crashes due non-initialized internal properties_table).
(Felipe)

33
Zend/tests/bug62653.phpt Normal file
View File

@@ -0,0 +1,33 @@
--TEST--
Bug #62653: unset($array[$float]) causes a crash
--FILE--
<?php
$array = array("5"=>"bar");
$foo = "10.0000"; // gettype($foo) = "string"
$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double"
unset($array[$foo]);
print_r($array);
$array = array("5"=>"bar");
$foo = "5";
unset($array[(float)$foo]);
print_r($array);
$array = array("5"=>"bar");
$foo = "5";
$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double"
$name = "foo";
unset($array[$$name]);
print_r($array);
?>
--EXPECT--
Array
(
)
Array
(
)
Array
(
)

3
Zend/zend_vm_def.h
View File

@@ -3947,7 +3947,8 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
ZEND_VM_C_GOTO(num_index_dim);
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:

36
Zend/zend_vm_execute.h
View File

@@ -13917,7 +13917,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -15919,7 +15920,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLE
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -18131,7 +18133,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -21166,7 +21169,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -22504,7 +22508,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_H
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -23662,7 +23667,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HAN
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -24820,7 +24826,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HAN
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -26244,7 +26251,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HAND
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -29498,7 +29506,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -31371,7 +31380,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -33453,7 +33463,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG:
@@ -36219,7 +36230,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_
switch (Z_TYPE_P(offset)) {
case IS_DOUBLE:
hval = zend_dval_to_lval(Z_DVAL_P(offset));
goto num_index_dim;
zend_hash_index_del(ht, hval);
break;
case IS_RESOURCE:
case IS_BOOL:
case IS_LONG: