Fixed bug #64578 (debug_backtrace in set_error_handler corrupts zend heap: segfault)

NEWS

@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2013, PHP 5.3.25
 
+- Core:
+  . Fixed bug #64578 (debug_backtrace in set_error_handler corrupts zend heap: 
+	segfault). (Laruence)
 
 
 ?? ??? 2013, PHP 5.3.24

Zend/tests/bug64578.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #64578 (debug_backtrace in set_error_handler corrupts zend heap: segfault)
+--FILE--
+<?php
+function x($s) { 
+	$resource = fopen("php://input", "r"); 
+	$s[$resource] = '2';
+}
+$y = "1";
+x($y);
+var_dump($y);
+?>
+--EXPECTF--
+Warning: Illegal offset type in %sbug64578.php on line %d
+string(1) "1"

Zend/zend_execute.c

@@ -937,6 +937,10 @@ convert_to_array:
 					zend_error_noreturn(E_ERROR, "[] operator not supported for strings");
 				}
 
+				if (type != BP_VAR_UNSET) {
+					SEPARATE_ZVAL_IF_NOT_REF(container_ptr);
+				}
+
 				if (Z_TYPE_P(dim) != IS_LONG) {
 					switch(Z_TYPE_P(dim)) {
 						/* case IS_LONG: */
@@ -956,9 +960,6 @@ convert_to_array:
 					convert_to_long(&tmp);
 					dim = &tmp;
 				}
-				if (type != BP_VAR_UNSET) {
-					SEPARATE_ZVAL_IF_NOT_REF(container_ptr);
-				}
 				container = *container_ptr;
 				result->str_offset.str = container;
 				PZVAL_LOCK(container);