cvs: ZendEngine2(PHP_5_2) / zend_object_handlers.c /tests bug39297.phpt php-src NEWS

dmitry Wed Nov 8 13:38:29 2006 UTC Added files: (Branch: PHP_5_2) /ZendEngine2/tests bug39297.phpt Modified files: /php-src NEWS /ZendEngine2 zend_object_handlers.c Log: Fixed bug #39297 (Memory corryption because of indirect modification of overloaded array). http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.339&r2=1.2027.2.547.2.340&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.339 php-src/NEWS:1.2027.2.547.2.340 --- php-src/NEWS:1.2027.2.547.2.339 Wed Nov 8 11:04:27 2006 +++ php-src/NEWS Wed Nov 8 13:38:28 2006 @@ -30,6 +30,8 @@ an extension INI directive). (wharmby at uk dot ibm dot com, Dmitry) - Fixed bug #39320 (ZEND_HASH_APPLY_STOP causes deletion). (Marcus) - Fixed bug #39313 (spl_autoload triggers Fatal error). (Marcus) +- Fixed bug #39297 (Memory corryption because of indirect modification + of overloaded array). (Dmitry) - Fixed bug #39265 (Fixed path handling inside mod_files.sh). (michal dot taborsky at gmail dot com, Ilia) - Fixed bug #39215 (Inappropriate close of stdin/stdout/stderr). (Wez,Ilia) http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_object_handlers.c?r1=1.135.2.6.2.15&r2=1.135.2.6.2.16&diff_format=u Index: ZendEngine2/zend_object_handlers.c diff -u ZendEngine2/zend_object_handlers.c:1.135.2.6.2.15 ZendEngine2/zend_object_handlers.c:1.135.2.6.2.16 --- ZendEngine2/zend_object_handlers.c:1.135.2.6.2.15 Tue Sep 12 11:01:16 2006 +++ ZendEngine2/zend_object_handlers.c Wed Nov 8 13:38:28 2006 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_object_handlers.c,v 1.135.2.6.2.15 2006/09/12 11:01:16 dmitry Exp $ */ +/* $Id: zend_object_handlers.c,v 1.135.2.6.2.16 2006/11/08 13:38:28 dmitry Exp $ */ #include "zend.h" #include "zend_globals.h" @@ -469,6 +469,19 @@ /* Undo PZVAL_LOCK() */ retval->refcount--; + if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && retval->refcount > 0) { + zval *tmp = retval; + + ALLOC_ZVAL(retval); + *retval = *tmp; + zval_copy_ctor(retval); + retval->is_ref = 0; + retval->refcount = 0; + if (Z_TYPE_P(retval) != IS_OBJECT) { + zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ce->name); + } + } + return retval; } else { zend_error(E_ERROR, "Cannot use object of type %s as array", ce->name); http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug39297.phpt?view=markup&rev=1.1 Index: ZendEngine2/tests/bug39297.phpt +++ ZendEngine2/tests/bug39297.phpt