svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/Zend/zend_object_handlers.c trunk/Zend/zend_object_handlers.c
| From: | Dmitry Stogov | Date: | Thu, 07 Apr 2011 13:35:27 +0000 |
| Subject: | svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/Zend/zend_object_handlers.c trunk/Zend/zend_object_handlers.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-64800@lists.php.net to get a copy of this message | ||
dmitry Thu, 07 Apr 2011 13:35:27 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=310009
Log:
Fixed bug #54372 (Crash accessing global object itself returned from its __get() handle)
Bug: http://bugs.php.net/54372 (Assigned) Crash accessing
global object itself returned from its __get() handle
Changed paths:
U php/php-src/branches/PHP_5_3/NEWS
U php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c
U php/php-src/trunk/Zend/zend_object_handlers.c
Modified: php/php-src/branches/PHP_5_3/NEWS
===================================================================
--- php/php-src/branches/PHP_5_3/NEWS 2011-04-07 12:36:04 UTC (rev 310008)
+++ php/php-src/branches/PHP_5_3/NEWS 2011-04-07 13:35:27 UTC (rev 310009)
@@ -4,6 +4,8 @@
- Zend Engine:
. Fixed bug #54423 (classes from dl()'ed extensions are not destroyed).
(Tony, Dmitry)
+ . Fixed bug #54372 (Crash accessing global object itself returned from its
+ __get() handle). (Dmitry)
. Fixed bug #54262 (Crash when assigning value to a dimension in a non-array).
(Dmitry)
Modified: php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c
===================================================================
--- php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c 2011-04-07 12:36:04 UTC (rev 310008)
+++ php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c 2011-04-07 13:35:27 UTC (rev 310009)
@@ -374,7 +374,11 @@
} else {
retval = &EG(uninitialized_zval_ptr);
}
- zval_ptr_dtor(&object);
+ if (EXPECTED(*retval != object)) {
+ zval_ptr_dtor(&object);
+ } else {
+ Z_DELREF_P(object);
+ }
} else {
if (zobj->ce->__get && guard && guard->in_get == 1) {
if (Z_STRVAL_P(member)[0] == '\0') {
Modified: php/php-src/trunk/Zend/zend_object_handlers.c
===================================================================
--- php/php-src/trunk/Zend/zend_object_handlers.c 2011-04-07 12:36:04 UTC (rev 310008)
+++ php/php-src/trunk/Zend/zend_object_handlers.c 2011-04-07 13:35:27 UTC (rev 310009)
@@ -446,7 +446,11 @@
} else {
retval = &EG(uninitialized_zval_ptr);
}
- zval_ptr_dtor(&object);
+ if (EXPECTED(*retval != object)) {
+ zval_ptr_dtor(&object);
+ } else {
+ Z_DELREF_P(object);
+ }
} else {
if (zobj->ce->__get && guard && guard->in_get == 1) {
if (Z_STRVAL_P(member)[0] == '\0') {