fix for bug #26696
| From: | Sterling Hughes | Date: | Tue, 13 Jan 2004 20:03:30 +0000 |
| Subject: | fix for bug #26696 | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-7059@lists.php.net to get a copy of this message | ||
Hey,
I've attached a fix for an engine level crash in switch() when it is
used with string offsets. This eliminates a double-free and valgrind
reports that no new leaks have been introduced.
-Sterling
Index: zend_execute.c =================================================================== RCS file: /repository/ZendEngine2/zend_execute.c,v retrieving revision 1.582 diff -u -r1.582 zend_execute.c --- zend_execute.c 8 Jan 2004 17:31:47 -0000 1.582 +++ zend_execute.c 13 Jan 2004 19:58:18 -0000 @@ -194,13 +194,7 @@ { switch (opline->op1.op_type) { case IS_VAR: - if (!T(opline->op1.u.var).var.ptr_ptr) { - temp_variable *T = &T(opline->op1.u.var); - /* perform the equivalent of equivalent of a - * quick & silent get_zval_ptr, and FREE_OP - */ - PZVAL_UNLOCK(T->var.str_offset.str); - } else { + if (T(opline->op1.u.var).var.ptr_ptr) { zval_ptr_dtor(&T(opline->op1.u.var).var.ptr); if (opline->extended_value) { /* foreach() free */ zval_ptr_dtor(&T(opline->op1.u.var).var.ptr);
Index: zend_execute.c =================================================================== RCS file: /repository/ZendEngine2/zend_execute.c,v retrieving revision 1.582 diff -u -r1.582 zend_execute.c --- zend_execute.c 8 Jan 2004 17:31:47 -0000 1.582 +++ zend_execute.c 13 Jan 2004 19:58:18 -0000 @@ -194,13 +194,7 @@ { switch (opline->op1.op_type) { case IS_VAR: - if (!T(opline->op1.u.var).var.ptr_ptr) { - temp_variable *T = &T(opline->op1.u.var); - /* perform the equivalent of equivalent of a - * quick & silent get_zval_ptr, and FREE_OP - */ - PZVAL_UNLOCK(T->var.str_offset.str); - } else { + if (T(opline->op1.u.var).var.ptr_ptr) { zval_ptr_dtor(&T(opline->op1.u.var).var.ptr); if (opline->extended_value) { /* foreach() free */ zval_ptr_dtor(&T(opline->op1.u.var).var.ptr);