Re: com php-src: Partial fix for bug #68365 (zend_mm_heap corrupted after memory overflow in zend_hash_copy): Zend/zend_variables.c

On Fri, Nov 7, 2014 at 7:46 AM, Dmitry Stogov <dmitry@php.net> wrote: > Commit: 9dfa843a386b65b18353c510f032e322004d0bb7 > Author: Dmitry Stogov <dmitry@zend.com> Fri, 7 Nov 2014 > 09:46:49 +0300 > Parents: 0ddcf2a919a24cccb36bd0a69b05e6bbfc0bf883 > Branches: PHP-5.4 PHP-5.5 PHP-5.6 master > > Link: > > http://git.php.net/?p=php-src.git;a=commitdiff;h=9dfa843a386b65b18353c510f032e322004d0bb7 > > Log: > Partial fix for bug #68365 (zend_mm_heap corrupted after memory overflow > in zend_hash_copy) > > Bugs: > https://bugs.php.net/68365 > > Changed paths: > M Zend/zend_variables.c > > > Diff: > diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c > index 9674de5..cc73c37 100644 > --- a/Zend/zend_variables.c > +++ b/Zend/zend_variables.c > @@ -135,9 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue > ZEND_FILE_LINE_DC) > } > ALLOC_HASHTABLE_REL(tmp_ht); > zend_hash_init(tmp_ht, > zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0); > + zvalue->value.ht = tmp_ht; > zend_hash_copy(tmp_ht, original_ht, > (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *)); > tmp_ht->nNextFreeElement = > original_ht->nNextFreeElement; > - zvalue->value.ht = tmp_ht; > } > break; > case IS_OBJECT: > > > -- > PHP CVS Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > could you please also add a NEWS entry for this? as the issue in the bugtracker is closed, and the report was about the specific scenario that we fixed, I think we should consider this particular issue# to be fixed(from NEWS point-of-view), regardless if there are other issues which can trigger similar problems. -- Ferenc Kovács @Tyr43l - http://tyrael.hu