# Source: upstream

# http://git.php.net/?p=php-src.git;a=commitdiff;h=f57cb13c566613eec0e1c2f6d96d18565436a9b7

# https://bugs.php.net/bug.php?id=70083

# Security

From f57cb13c566613eec0e1c2f6d96d18565436a9b7 Mon Sep 17 00:00:00 2001

From: Bob Weinand <[email protected]>

Date: Wed, 15 Jul 2015 22:46:53 +0200

Subject: [PATCH] Backport fix for bug #70083 to PHP-5.6

---

 Zend/zend_vm_def.h     |  7 ++++---

 Zend/zend_vm_execute.h | 28 ++++++++++++++++------------

 2 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h

index 11f6205..7bfa814 100644

--- a/Zend/zend_vm_def.h

+++ b/Zend/zend_vm_def.h

@@ -1774,6 +1774,10 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)

 	SAVE_OPLINE();

 	value_ptr_ptr = GET_OP2_ZVAL_PTR_PTR(BP_VAR_W);

+	if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

+	}

+

 	if (OP2_TYPE == IS_VAR &&

 	    value_ptr_ptr &&

 	    !Z_ISREF_PP(value_ptr_ptr) &&

@@ -1791,9 +1795,6 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)

 	} else if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {

 		PZVAL_LOCK(*value_ptr_ptr);

 	}

-	if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

-	}

 	variable_ptr_ptr = GET_OP1_ZVAL_PTR_PTR(BP_VAR_W);

 	if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h

index 5ed4135..07b9abc 100644

--- a/Zend/zend_vm_execute.h

+++ b/Zend/zend_vm_execute.h

@@ -20331,6 +20331,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL

 	SAVE_OPLINE();

 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);

+	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

+	}

+

 	if (IS_VAR == IS_VAR &&

 	    value_ptr_ptr &&

 	    !Z_ISREF_PP(value_ptr_ptr) &&

@@ -20348,9 +20352,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL

 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {

 		PZVAL_LOCK(*value_ptr_ptr);

 	}

-	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);

 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||

@@ -23801,6 +23802,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE

 	SAVE_OPLINE();

 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);

+	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

+	}

+

 	if (IS_CV == IS_VAR &&

 	    value_ptr_ptr &&

 	    !Z_ISREF_PP(value_ptr_ptr) &&

@@ -23818,9 +23823,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE

 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {

 		PZVAL_LOCK(*value_ptr_ptr);

 	}

-	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);

 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||

@@ -37492,6 +37494,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE

 	SAVE_OPLINE();

 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);

+	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

+	}

+

 	if (IS_VAR == IS_VAR &&

 	    value_ptr_ptr &&

 	    !Z_ISREF_PP(value_ptr_ptr) &&

@@ -37509,9 +37515,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE

 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {

 		PZVAL_LOCK(*value_ptr_ptr);

 	}

-	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);

 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||

@@ -40675,6 +40678,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER

 	SAVE_OPLINE();

 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);

+	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

+	}

+

 	if (IS_CV == IS_VAR &&

 	    value_ptr_ptr &&

 	    !Z_ISREF_PP(value_ptr_ptr) &&

@@ -40692,9 +40699,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER

 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {

 		PZVAL_LOCK(*value_ptr_ptr);

 	}

-	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {

-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");

-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);

 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||

-- 

2.1.4