Fixed bug #33116 (crash when assigning class name to global variable in __autoload).

Author: dstogov

Zend/tests/bug33116.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #33116 (crash when assigning class name to global variable in __autoload)
+--FILE--
+<?php
+function __autoload($class)
+{
+  $GLOBALS['include'][] = $class;
+  eval("class DefClass{}");
+}
+
+$a = new DefClass;
+print_r($a);
+print_r($GLOBALS['include']);
+?>
+--EXPECT--
+DefClass Object
+(
+)
+Array
+(
+    [0] => DefClass
+)

Zend/zend_execute_API.c

@@ -895,7 +895,7 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
 {
 	zval **args[1];
 	zval autoload_function;
-	zval class_name, *class_name_ptr = &class_name;
+	zval *class_name_ptr;
 	zval *retval_ptr;
 	int retval;
 	char *lc_name;
@@ -936,8 +936,9 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
 
 	ZVAL_STRINGL(&autoload_function, ZEND_AUTOLOAD_FUNC_NAME, sizeof(ZEND_AUTOLOAD_FUNC_NAME)-1,  0);
 
+	ALLOC_ZVAL(class_name_ptr);
 	INIT_PZVAL(class_name_ptr);
-	ZVAL_STRINGL(class_name_ptr, name, name_length, 0);
+	ZVAL_STRINGL(class_name_ptr, name, name_length, 1);
 
 	args[0] = &class_name_ptr;
 
@@ -961,6 +962,8 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
 	retval = zend_call_function(&fcall_info, &fcall_cache TSRMLS_CC);
 	EG(autoload_func) = fcall_cache.function_handler;
 
+	zval_ptr_dtor(&class_name_ptr);
+
 	zend_hash_del(EG(in_autoload), lc_name, name_length+1);
 
 	if (retval == FAILURE) {