com php-src: Fix $arr =& $arr[0]: Zend/zend _execute.c
| From: | Nikita Popov | Date: | Sun, 05 Oct 2014 20:58:40 +0000 |
| Subject: | com php-src: Fix $arr =& $arr[0]: Zend/zend _execute.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-82115@lists.php.net to get a copy of this message | ||
Commit: fb34cd90f8a26d32f4eab179c4192d13a87c856c
Author: Nikita Popov <nikic@php.net> Sun, 5 Oct 2014 22:58:40 +0200
Parents: 24315f2dd7ddc55011f82dc7d49964f8b2c2b799
Branches: master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=fb34cd90f8a26d32f4eab179c4192d13a87c856c
Log:
Fix $arr =& $arr[0]
value_ptr can be invalidated by the ptr_dtor, so backup the
zend_reference in an extra variable.
Changed paths:
M Zend/zend_execute.c
Diff:
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index e019191..45911a8 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -462,10 +462,13 @@ static inline zval *_get_obj_zval_ptr_ptr(int op_type, const znode_op *node,
zen
static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr TSRMLS_DC)
{
if (EXPECTED(variable_ptr != value_ptr)) {
+ zend_reference *ref;
ZVAL_MAKE_REF(value_ptr);
Z_ADDREF_P(value_ptr);
+ ref = Z_REF_P(value_ptr);
+
zval_ptr_dtor(variable_ptr);
- ZVAL_REF(variable_ptr, Z_REF_P(value_ptr));
+ ZVAL_REF(variable_ptr, ref);
} else {
ZVAL_MAKE_REF(variable_ptr);
}