Merge remote-tracking branch 'php/master'

Zend/tests/bug67874.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #67874 Crash in array_map()
+--FILE--
+<?php
+$a = array(1,2,3);
+$data = array($a);
+$data = array_map('current', $data);
+var_dump($data);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}

Zend/zend_vm_def.h

@@ -4539,7 +4539,7 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 				}
 				ZVAL_DUP(&tmp, array_ref);
 				array_ptr = array_ref = &tmp;
-			} else if (OP1_TYPE == IS_CV) {
+			} else if (OP1_TYPE == IS_CV || OP1_TYPE == IS_VAR) {
 				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
@@ -4553,7 +4553,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 					}
 					zval_copy_ctor(array_ptr);
 				}
-				Z_ADDREF_P(array_ref);
+				if (OP1_TYPE == IS_CV) {
+					Z_ADDREF_P(array_ref);
+				}
 			}
 		}
 	}

Zend/zend_vm_execute.h

@@ -3156,7 +3156,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A
 				}
 				ZVAL_DUP(&tmp, array_ref);
 				array_ptr = array_ref = &tmp;
-			} else if (IS_CONST == IS_CV) {
+			} else if (IS_CONST == IS_CV || IS_CONST == IS_VAR) {
 				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
@@ -3170,7 +3170,9 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A
 					}
 					zval_copy_ctor(array_ptr);
 				}
-				Z_ADDREF_P(array_ref);
+				if (IS_CONST == IS_CV) {
+					Z_ADDREF_P(array_ref);
+				}
 			}
 		}
 	}
@@ -8679,7 +8681,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG
 				}
 				ZVAL_DUP(&tmp, array_ref);
 				array_ptr = array_ref = &tmp;
-			} else if (IS_TMP_VAR == IS_CV) {
+			} else if (IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) {
 				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
@@ -8693,7 +8695,9 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG
 					}
 					zval_copy_ctor(array_ptr);
 				}
-				Z_ADDREF_P(array_ref);
+				if (IS_TMP_VAR == IS_CV) {
+					Z_ADDREF_P(array_ref);
+				}
 			}
 		}
 	}
@@ -14122,7 +14126,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 				}
 				ZVAL_DUP(&tmp, array_ref);
 				array_ptr = array_ref = &tmp;
-			} else if (IS_VAR == IS_CV) {
+			} else if (IS_VAR == IS_CV || IS_VAR == IS_VAR) {
 				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
@@ -14136,7 +14140,9 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 					}
 					zval_copy_ctor(array_ptr);
 				}
-				Z_ADDREF_P(array_ref);
+				if (IS_VAR == IS_CV) {
+					Z_ADDREF_P(array_ref);
+				}
 			}
 		}
 	}
@@ -31483,7 +31489,7 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 				}
 				ZVAL_DUP(&tmp, array_ref);
 				array_ptr = array_ref = &tmp;
-			} else if (IS_CV == IS_CV) {
+			} else if (IS_CV == IS_CV || IS_CV == IS_VAR) {
 				if (Z_ISREF_P(array_ref) && Z_REFCOUNT_P(array_ref) == 1) {
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
@@ -31497,7 +31503,9 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 					}
 					zval_copy_ctor(array_ptr);
 				}
-				Z_ADDREF_P(array_ref);
+				if (IS_CV == IS_CV) {
+					Z_ADDREF_P(array_ref);
+				}
 			}
 		}
 	}

ext/session/tests/session_module_name_variation3.phpt

@@ -48,4 +48,4 @@ Stack trace:
 #2 {main}
   thrown in %s on line %d
 
-Fatal error: session_start(): Failed to initialize storage module: %s in %s/session_module_name_variation3.php on line %d
+Fatal error: session_start(): Failed to initialize storage module: %s in %s%esession_module_name_variation3.php on line %d

ext/standard/array.c

@@ -4438,7 +4438,7 @@ PHP_FUNCTION(array_map)
 	if (n_arrays == 1) {
 		php_uint_t num_key;
 		zend_string *str_key;
-		zval *zv;
+		zval *zv, arg;
 
 		if (Z_TYPE(arrays[0]) != IS_ARRAY) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument #%d should be an array", 2);
@@ -4457,20 +4457,18 @@ PHP_FUNCTION(array_map)
 		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(arrays[0]), num_key, str_key, zv) {
 			fci.retval = &result;
 			fci.param_count = 1;
-			fci.params = zv;
+			fci.params = &arg;
 			fci.no_separation = 0;
 			
-			if (Z_REFCOUNTED_P(zv)) {
-				Z_ADDREF_P(zv);
-			}
+			ZVAL_COPY(&arg, zv);
 
 			if (zend_call_function(&fci, &fci_cache TSRMLS_CC) != SUCCESS || Z_TYPE(result) == IS_UNDEF) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the map callback");
 				zval_dtor(return_value);
-				zval_ptr_dtor(zv);
+				zval_ptr_dtor(&arg);
 				RETURN_NULL();
 			} else {
-				zval_ptr_dtor(zv);
+				zval_ptr_dtor(&arg);
 			}
 			if (str_key) {
 				zend_hash_add_new(Z_ARRVAL_P(return_value), str_key, &result);