diff --git a/Zend/tests/bug47572.phpt b/Zend/tests/bug47572.phpt new file mode 100644 index 00000000000..695cc3a7f9b --- /dev/null +++ b/Zend/tests/bug47572.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #47572 (zval_update_constant_ex: Segmentation fault) +--FILE-- + "bar" + ); + +} + +$foo = new Foo(); + +?> +--EXPECTF-- +Notice: Use of undefined constant FOO - assumed 'FOO' in %s on line %d diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 36240eefce5..f0f823719bc 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -575,7 +575,7 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco } else if (Z_TYPE_P(p) == IS_CONSTANT_ARRAY) { zval **element, *new_val; char *str_index; - uint str_index_len; + uint str_index_len = 0; ulong num_index; int ret; @@ -613,9 +613,11 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco str_index = colon; } else { if (str_index[str_index_len - 2] & IS_CONSTANT_UNQUALIFIED) { - actual = (char *)zend_memrchr(str_index, '\\', str_index_len - 3) + 1; + if ((actual = (char *)zend_memrchr(str_index, '\\', str_index_len - 3))) { + actual++; str_index_len -= (actual - str_index); - str_index = actual; + str_index = save; + } } if (str_index[0] == '\\') { ++str_index;