com php-src: Fixed usage after free(): Zend/zend_operators. c
| From: | Dmitry Stogov | Date: | Thu, 10 Jul 2014 17:45:09 +0000 |
| Subject: | com php-src: Fixed usage after free(): Zend/zend_operators. c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-79374@lists.php.net to get a copy of this message | ||
Commit: 4e291fab81eb8c7517d673705ae8a46bf178724b
Author: Dmitry Stogov <dmitry@zend.com> Thu, 10 Jul 2014 21:45:09 +0400
Parents: d81b287ce1f30fdc3d37eb4d30ac116073ee1329
Branches: phpng
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=4e291fab81eb8c7517d673705ae8a46bf178724b
Log:
Fixed usage after free()
Changed paths:
M Zend/zend_operators.c
Diff:
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 4e7b479..76c7327 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -627,12 +627,13 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC) /* {{{ */
TSRMLS_FETCH();
convert_object_to_type(op, &dst, IS_STRING, convert_to_string);
- zval_dtor(op);
if (Z_TYPE(dst) == IS_STRING) {
+ zval_dtor(op);
ZVAL_COPY_VALUE(op, &dst);
} else {
zend_error(E_NOTICE, "Object of class %s to string conversion",
Z_OBJCE_P(op)->name->val);
+ zval_dtor(op);
ZVAL_NEW_STR(op, STR_INIT("Object", sizeof("Object")-1, 0));
}
break;