archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed crash of invalid pointer derefer

Browse source
This commit is contained in:
Xinchen Hui 2015-07-07 11:29:14 +08:00
parent e04500ceda
commit 653abc670b
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Zend/zend_execute.c
View file

@ -2361,12 +2361,12 @@ static zend_always_inline void i_cleanup_unfinished_execution(zend_execute_data
{ {
if (EX(func)->op_array.T_liveliness if (EX(func)->op_array.T_liveliness
&& op_num < EX(func)->op_array.last && op_num < EX(func)->op_array.last
&& EX(func)->op_array.T_liveliness[op_num] != (uint32_t) - 1) { && EX(func)->op_array.T_liveliness[op_num] != (uint32_t)-1) {
uint32_t *off = EX(func)->op_array.T_liveliness + EX(func)->op_array.T_liveliness[op_num]; uint32_t *off = EX(func)->op_array.T_liveliness + EX(func)->op_array.T_liveliness[op_num];
uint32_t *catch_off = NULL; uint32_t *catch_off = NULL;
uint32_t var = *off; uint32_t var = *off;
if (catch_op_num) { if (catch_op_num && EX(func)->op_array.T_liveliness[catch_op_num] != (uint32_t)-1) {
catch_off = EX(func)->op_array.T_liveliness + EX(func)->op_array.T_liveliness[catch_op_num]; catch_off = EX(func)->op_array.T_liveliness + EX(func)->op_array.T_liveliness[catch_op_num];
} }