Fixed bug #63899 (Use after scope error in zend_compile)

laruence · laruence · commit c3e6de2227f0 · 2013-01-04T11:02:21.000+08:00
diff --git a/NEWS b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 ?? ??? 2013, PHP 5.3.22
 
 - Zend Engine:
+  . Fixed bug #63899 (Use after scope error in zend_compile). (Laruence)
   . Fixed bug #63762 (Sigsegv when Exception::$trace is changed by user).
     (Johannes)
 
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
@@ -3417,7 +3417,7 @@ void zend_do_begin_class_declaration(const znode *class_token, znode *class_name
 		tmp.u.constant = *CG(current_namespace);
 		zval_copy_ctor(&tmp.u.constant);
 		zend_do_build_namespace_name(&tmp, &tmp, class_name TSRMLS_CC);
-		class_name = &tmp;
+		*class_name = tmp;
 		efree(lcname);
 		lcname = zend_str_tolower_dup(Z_STRVAL(class_name->u.constant), Z_STRLEN(class_name->u.constant));
 	}

Original file line number	Diff line number	Diff line change
`@@ -3417,7 +3417,7 @@ void zend_do_begin_class_declaration(const znode class_token, znode class_name`
`3417`	`3417`	`tmp.u.constant = *CG(current_namespace);`
`3418`	`3418`	`zval_copy_ctor(&tmp.u.constant);`
`3419`	`3419`	`zend_do_build_namespace_name(&tmp, &tmp, class_name TSRMLS_CC);`
`3420`		`- class_name = &tmp;`
	`3420`	`+ *class_name = tmp;`
`3421`	`3421`	`efree(lcname);`
`3422`	`3422`	`lcname = zend_str_tolower_dup(Z_STRVAL(class_name->u.constant), Z_STRLEN(class_name->u.constant));`
`3423`	`3423`	`}`