com php-src: Partial fix for bug #68365 (zend_mm_heap c orrupted after memory overflow in zend_hash_copy ): Zend/zend_variables.c
| From: | Ferenc Kovacs | Date: | Wed, 12 Nov 2014 01:06:30 +0000 |
| Subject: | com php-src: Partial fix for bug #68365 (zend_mm_heap c orrupted after memory overflow in zend_hash_copy ): Zend/zend_variables.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-83039@lists.php.net to get a copy of this message | ||
Commit: 6e9144de5a3b60af92df8aa9076675c5a9611547
Author: Dmitry Stogov <dmitry@zend.com> Fri, 7 Nov 2014 09:46:49 +0300
Committer: Ferenc Kovacs <tyrael@php.net> Wed, 12 Nov 2014 02:06:30 +0100
Parents: 01b665ee7e1a16ca112eb881b3f34b4f49e9d7fe
Branches: PHP-5.6.3
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=6e9144de5a3b60af92df8aa9076675c5a9611547
Log:
Partial fix for bug #68365 (zend_mm_heap corrupted after memory overflow in zend_hash_copy)
Bugs:
https://bugs.php.net/68365
Changed paths:
M Zend/zend_variables.c
Diff:
diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c
index 8a41902..75230ba 100644
--- a/Zend/zend_variables.c
+++ b/Zend/zend_variables.c
@@ -137,9 +137,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
}
ALLOC_HASHTABLE_REL(tmp_ht);
zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
+ zvalue->value.ht = tmp_ht;
zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp,
sizeof(zval *));
tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
- zvalue->value.ht = tmp_ht;
}
break;
case IS_CONSTANT_AST: