Re: [ZEND-ENGINE-CVS] cvs: ZendEngine2 / zend_execute.c /tests bug26281.phpt

Your patch might be correct. I think it might be better to use get_zval_ptr() at that point and then just use FREE_OP() which will call zval_dtor(). Did you try that? It would be much cleaner. Andi At 12:41 AM 11/19/2003 +0000, Ilia Alshanetsky wrote:

iliaa           Tue Nov 18 19:41:14 2003 EDT

Added files:

    /ZendEngine2/tests  bug26281.phpt

Modified files:

    /ZendEngine2        zend_execute.c

Log: Possible fix for bug #26281 & test case. Index: ZendEngine2/zend_execute.c diff -u ZendEngine2/zend_execute.c:1.549 ZendEngine2/zend_execute.c:1.550

--- ZendEngine2/zend_execute.c:1.549    Mon Nov 10 11:23:12 2003

+++ ZendEngine2/zend_execute.c Tue Nov 18 19:41:14 2003 @@ -17,7 +17,7 @@

    +----------------------------------------------------------------------+

*/ -/* $Id: zend_execute.c,v 1.549 2003/11/10 16:23:12 helly Exp $ */ +/* $Id: zend_execute.c,v 1.550 2003/11/19 00:41:14 iliaa Exp $ */ #define ZEND_INTENSIVE_DEBUGGING 0 @@ -200,7 +200,9 @@

                                * quick & silent get_zval_ptr, and FREE_OP
                                */
                                PZVAL_UNLOCK(T->EA.data.str_offset.str);

+#ifdef ilia_0 /* attempts to free already freed data */

                                zval_dtor(&T->tmp_var);

+#endif

                        } else {
                                zval_ptr_dtor(&T(opline->op1.u.var).var.ptr);
                                if (opline->extended_value) { /* foreach() free */

Index: ZendEngine2/tests/bug26281.phpt +++ ZendEngine2/tests/bug26281.phpt --TEST-- Bug #26281 (switch() crash when condition is a string offset) --FILE-- <?php

        $x = 'abc';
        switch ($x{0}) {
                case 'a':
                        echo "no crash\n";
                        break;
        }

?> --EXPECT-- no crash -- Zend Engine CVS Mailing List (http://cvs.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php