[PHP-CVS] cvs: php-src /ext/spl spl_directory.c /ext/spl/tests dit_003.phpt

[Marcus Boerger]

helly           Thu Mar 13 19:45:22 2008 UTC

  Added files:                 
    /php-src/ext/spl/tests      dit_003.phpt 

  Modified files:              
    /php-src/ext/spl    spl_directory.c 
  Log:
  - Fix possible memory corruption
  
http://cvs.php.net/viewvc.cgi/php-src/ext/spl/spl_directory.c?r1=1.149&r2=1.150&diff_format=u
Index: php-src/ext/spl/spl_directory.c
diff -u php-src/ext/spl/spl_directory.c:1.149 
php-src/ext/spl/spl_directory.c:1.150
--- php-src/ext/spl/spl_directory.c:1.149       Wed Feb 13 12:01:16 2008
+++ php-src/ext/spl/spl_directory.c     Thu Mar 13 19:45:22 2008
@@ -16,7 +16,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: spl_directory.c,v 1.149 2008/02/13 12:01:16 helly Exp $ */
+/* $Id: spl_directory.c,v 1.150 2008/03/13 19:45:22 helly Exp $ */
 
 #ifdef HAVE_CONFIG_H
 # include "config.h"
@@ -1403,10 +1403,11 @@
 static void spl_filesystem_dir_it_dtor(zend_object_iterator *iter TSRMLS_DC)
 {
        spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter;
+       zval *zfree = (zval*)iterator->intern.data;
 
-       zval_ptr_dtor(&iterator->current);
-       zval_ptr_dtor((zval**)&iterator->intern.data);
        iterator->intern.data = NULL; /* mark as unused */
+       zval_ptr_dtor(&iterator->current);
+       zval_ptr_dtor(&zfree);
 }
 /* }}} */
 
@@ -1469,12 +1470,15 @@
 static void spl_filesystem_tree_it_dtor(zend_object_iterator *iter TSRMLS_DC)
 {
        spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter;
+       zval *zfree = (zval*)iterator->intern.data;
 
        if (iterator->current) {
                zval_ptr_dtor(&iterator->current);
        }
-       zval_ptr_dtor((zval**)&iterator->intern.data);
        iterator->intern.data = NULL; /* mark as unused */
+       /* free twice as we add ref twice */
+       zval_ptr_dtor(&zfree);
+       zval_ptr_dtor(&zfree);
 }
 /* }}} */
 
@@ -1586,7 +1590,7 @@
        dir_object = 
(spl_filesystem_object*)zend_object_store_get_object(object TSRMLS_CC);
        iterator   = spl_filesystem_object_to_iterator(dir_object);
 
-       Z_ADDREF_P(object);
+       Z_SET_REFCOUNT_P(object, Z_REFCOUNT_P(object) + 2);
        iterator->intern.data = (void*)object;
        iterator->intern.funcs = &spl_filesystem_tree_it_funcs;
        iterator->current = NULL;

http://cvs.php.net/viewvc.cgi/php-src/ext/spl/tests/dit_003.phpt?view=markup&rev=1.1
Index: php-src/ext/spl/tests/dit_003.phpt
+++ php-src/ext/spl/tests/dit_003.phpt
--TEST--
SPL: FilesystemIterator and foreach
--SKIPIF--
<?php if (!extension_loaded("spl")) print "skip"; ?>
--FILE--
<?php
$count = 0;
foreach(new FilesystemIterator('CVS') as $ent)
{
        ++$count;
}
var_dump($count > 0);
?>
===DONE===
--EXPECTF--
bool(true)
===DONE===



-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php