Re: ZendEngine 2 - Double Free BUG

Stanislav Malyshev wrote:

SE>>Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); SE>> SE>>within this function z is freed and Why should write_property free z?

static int zend_std_call_setter(zval *object, zval *member, zval *value TSRMLS_DC) {

        zval **call_args[2];
        zval *retval = NULL;
        zval __set_name;
        int call_result;
        int ret;

        /* __set handler is called with two arguments:
           property name
           value to be set

           it should return whether the call was successfull or not
        */
        INIT_PZVAL(&__set_name);
        ZVAL_STRINGL(&__set_name, ZEND_SET_FUNC_NAME, sizeof(ZEND_SET_FUNC_NAME)-1, 0);

        call_args[0] = &member;
        value->refcount++;
        call_args[1] = &value;

        /* go call the __set handler */
        call_result = call_user_function_ex(NULL,

         &object,

         &__set_name,

         &retval,

         2, call_args,

         0, NULL TSRMLS_CC);

        /*
           call_result is if call_user_function gone OK.
           retval shows if __get method went OK.
        */

        if (call_result == FAILURE) {
                zend_error(E_ERROR, "Could not call __set handler for class %s", Z_OBJCE_P(object)->name);
                return FAILURE;
        }

        zval_ptr_dtor(&value);

Maybe you should ask the person who wrote it "why". Well the problem is not that it frees it. The problem is that the refcount is zero when the std_setter is called. Stefan