patch for bug #17115

Hello, The attached patch is the quick fix for bug #17115. The cause of this problem is that the hashtable that holds static variables of the lambda function being generated is wrongly destroyed in zend_hash_del() right after the call of zend_hash_add(), as function_add_ref() virtually copy-constructs the static variables as well as simply incrementing the reference count of op_array. Moriyoshi

Index: Zend/zend_builtin_functions.c =================================================================== RCS file: /repository/ZendEngine2/zend_builtin_functions.c,v retrieving revision 1.187 diff -u -r1.187 zend_builtin_functions.c --- Zend/zend_builtin_functions.c 21 Apr 2003 17:01:34 -0000 1.187 +++ Zend/zend_builtin_functions.c 24 May 2003 01:32:06 -0000 @@ -1260,20 +1260,22 @@ efree(eval_name); if (retval==SUCCESS) { - zend_function *func; + zend_function *pfunc; + zend_function func; - if (zend_hash_find(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME), (void **) &func)==FAILURE) { + if (zend_hash_find(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME), (void **) &pfunc)==FAILURE) { zend_error(E_ERROR, "Unexpected inconsistency in create_function()"); RETURN_FALSE; } - function_add_ref(func); + func = *pfunc; + function_add_ref(&func); /* func is virtually copy-constrcted here */ function_name = (char *) emalloc(sizeof("0lambda_")+MAX_LENGTH_OF_LONG); do { sprintf(function_name, "%clambda_%d", 0, ++EG(lambda_count)); function_name_length = strlen(function_name+1)+1; - } while (zend_hash_add(EG(function_table), function_name, function_name_length+1, func, sizeof(zend_function), NULL)==FAILURE); + } while (zend_hash_add(EG(function_table), function_name, function_name_length+1, &func, sizeof(zend_function), NULL)==FAILURE); zend_hash_del(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME)); RETURN_STRINGL(function_name, function_name_length, 0); } else {