From 1c204b9352ceafacd482db0babd179bc4767479c Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Fri, 1 Dec 2017 13:16:05 +0100
Subject: add upstream patch for https://bugs.php.net/75573

---
 php-bug75573.patch | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 php.spec           |   7 +++-
 2 files changed, 113 insertions(+), 1 deletion(-)
 create mode 100644 php-bug75573.patch

diff --git a/php-bug75573.patch b/php-bug75573.patch
new file mode 100644
index 0000000..46cf095
--- /dev/null
+++ b/php-bug75573.patch
@@ -0,0 +1,107 @@
+From 3b9ba7b6bd9e24bdbeca8e8e3f24cee2fccc51d8 Mon Sep 17 00:00:00 2001
+From: Xinchen Hui <laruence@gmail.com>
+Date: Wed, 29 Nov 2017 14:46:21 +0800
+Subject: [PATCH] Fixed bug #75573 (Segmentation fault in 7.1.12 and 7.0.26)
+
+---
+ NEWS                        |  1 +
+ Zend/tests/bug75573.phpt    | 64 +++++++++++++++++++++++++++++++++++++++++++++
+ Zend/zend_object_handlers.c | 10 +++----
+ 3 files changed, 69 insertions(+), 6 deletions(-)
+ create mode 100644 Zend/tests/bug75573.phpt
+
+diff --git a/Zend/tests/bug75573.phpt b/Zend/tests/bug75573.phpt
+new file mode 100644
+index 0000000..476ff6e
+--- /dev/null
++++ b/Zend/tests/bug75573.phpt
+@@ -0,0 +1,64 @@
++--TEST--
++Bug #75573 (Segmentation fault in 7.1.12 and 7.0.26)
++--FILE--
++<?php
++
++class A
++{
++	var $_stdObject;
++	function initialize($properties = FALSE) {
++		$this->_stdObject = $properties ? (object) $properties : new stdClass();
++		parent::initialize();
++	}
++	function &__get($property)
++	{
++		if (isset($this->_stdObject->{$property})) {
++			$retval =& $this->_stdObject->{$property};
++			return $retval;
++		} else {
++			return NULL;
++		}
++	}
++	function &__set($property, $value)
++	{
++		return $this->_stdObject->{$property} = $value;
++	}
++	function __isset($property_name)
++	{
++		return isset($this->_stdObject->{$property_name});
++	}
++}
++
++class B extends A
++{
++	function initialize($properties = array())
++	{
++		parent::initialize($properties);
++	}
++	function &__get($property)
++	{
++		if (isset($this->settings) && isset($this->settings[$property])) {
++			$retval =& $this->settings[$property];
++			return $retval;
++		} else {
++			return parent::__get($property);
++		}
++	}
++}
++
++$b = new B();
++$b->settings = [ "foo" => "bar", "name" => "abc" ];
++var_dump($b->name);
++var_dump($b->settings);
++?>
++--EXPECTF--
++Warning: Creating default object from empty value in %sbug75573.php on line %d
++
++Notice: Only variable references should be returned by reference in %sbug75573.php on line %d
++string(3) "abc"
++array(2) {
++  ["foo"]=>
++  string(3) "bar"
++  ["name"]=>
++  string(3) "abc"
++}
+diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
+index 10045b5..d9ebd84 100644
+--- a/Zend/zend_object_handlers.c
++++ b/Zend/zend_object_handlers.c
+@@ -668,13 +668,11 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
+ 			}
+ 			zval_ptr_dtor(&tmp_object);
+ 			goto exit;
+-		} else {
++		} else if (Z_STRVAL_P(member)[0] == '\0' && Z_STRLEN_P(member) != 0) {
+ 			zval_ptr_dtor(&tmp_object);
+-			if (Z_STRVAL_P(member)[0] == '\0' && Z_STRLEN_P(member) != 0) {
+-				zend_throw_error(NULL, "Cannot access property started with '\\0'");
+-				retval = &EG(uninitialized_zval);
+-				goto exit;
+-			}
++			zend_throw_error(NULL, "Cannot access property started with '\\0'");
++			retval = &EG(uninitialized_zval);
++			goto exit;
+ 		}
+ 	}
+ 
+-- 
+2.1.4
+
diff --git a/php.spec b/php.spec
index 4ca6a15..fe548a2 100644
--- a/php.spec
+++ b/php.spec
@@ -126,7 +126,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: %{?scl_prefix}php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -184,6 +184,7 @@ Patch48: php-7.1.9-openssl-load-config.patch
 Patch91: php-5.6.3-oci8conf.patch
 
 # Upstream fixes (100+)
+Patch100: php-bug75573.patch
 
 # Security fixes (200+)
 
@@ -896,6 +897,7 @@ support for JavaScript Object Notation (JSON) to PHP.
 %patch91 -p1 -b .remi-oci8
 
 # upstream patches
+%patch100 -p1 -b .bug75573
 
 # security patches
 
@@ -1821,6 +1823,9 @@ fi
 
 
 %changelog
+* Fri Dec  1 2017 Remi Collet <remi@remirepo.net> - 7.1.12-2
+- add upstream patch for https://bugs.php.net/75573
+
 * Wed Nov 22 2017 Remi Collet <remi@remirepo.net> - 7.1.12-1
 - Update to 7.1.12 - http://www.php.net/releases/7_1_12.php
 
-- 
cgit