svn: /php/php-src/ branches/PHP_5_4/NEWS branches/PHP_5_4/Zend/zend_object_handlers.c trunk/Zend/zend_object_handlers.c

laruence Mon, 19 Dec 2011 09:58:29 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=321158 Log: Fixed bug #60558 (Invalid read and writes) Bug: https://bugs.php.net/60558 (Open) Invalid read and writes Changed paths: U php/php-src/branches/PHP_5_4/NEWS U php/php-src/branches/PHP_5_4/Zend/zend_object_handlers.c U php/php-src/trunk/Zend/zend_object_handlers.c Modified: php/php-src/branches/PHP_5_4/NEWS =================================================================== --- php/php-src/branches/PHP_5_4/NEWS 2011-12-19 09:57:38 UTC (rev 321157) +++ php/php-src/branches/PHP_5_4/NEWS 2011-12-19 09:58:29 UTC (rev 321158) @@ -7,6 +7,7 @@ . Fixed bug #60536 (Traits Segfault). (Laruence) . Fixed bug #60362 (non-existent sub-sub keys should not have values). (Laruence, alan_k, Stas) + . Fixed bug #60558 (Invalid read and writes). (Laruence) - CLI SAPI: . Fixed bug #60477 (Segfault after two multipart/form-data POST requests, Modified: php/php-src/branches/PHP_5_4/Zend/zend_object_handlers.c =================================================================== --- php/php-src/branches/PHP_5_4/Zend/zend_object_handlers.c 2011-12-19 09:57:38 UTC (rev 321157) +++ php/php-src/branches/PHP_5_4/Zend/zend_object_handlers.c 2011-12-19 09:58:29 UTC (rev 321158) @@ -85,6 +85,7 @@ prop_info->offset >= 0 && zobj->properties_table[prop_info->offset]) { if (UNEXPECTED(flags[prop_info->offset])) { + Z_ADDREF_P(*(zval **)zobj->properties_table[prop_info->offset]); zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]); } else { zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)&zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]); Modified: php/php-src/trunk/Zend/zend_object_handlers.c =================================================================== --- php/php-src/trunk/Zend/zend_object_handlers.c 2011-12-19 09:57:38 UTC (rev 321157) +++ php/php-src/trunk/Zend/zend_object_handlers.c 2011-12-19 09:58:29 UTC (rev 321158) @@ -85,6 +85,7 @@ prop_info->offset >= 0 && zobj->properties_table[prop_info->offset]) { if (UNEXPECTED(flags[prop_info->offset])) { + Z_ADDREF_P(*(zval **)zobj->properties_table[prop_info->offset]); zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]); } else { zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)&zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]);