dmitry Thu, 07 Apr 2011 13:35:27 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=310009
Log: Fixed bug #54372 (Crash accessing global object itself returned from its __get() handle) Bug: http://bugs.php.net/54372 (Assigned) Crash accessing global object itself returned from its __get() handle Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c U php/php-src/trunk/Zend/zend_object_handlers.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-04-07 12:36:04 UTC (rev 310008) +++ php/php-src/branches/PHP_5_3/NEWS 2011-04-07 13:35:27 UTC (rev 310009) @@ -4,6 +4,8 @@ - Zend Engine: . Fixed bug #54423 (classes from dl()'ed extensions are not destroyed). (Tony, Dmitry) + . Fixed bug #54372 (Crash accessing global object itself returned from its + __get() handle). (Dmitry) . Fixed bug #54262 (Crash when assigning value to a dimension in a non-array). (Dmitry) Modified: php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c =================================================================== --- php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c 2011-04-07 12:36:04 UTC (rev 310008) +++ php/php-src/branches/PHP_5_3/Zend/zend_object_handlers.c 2011-04-07 13:35:27 UTC (rev 310009) @@ -374,7 +374,11 @@ } else { retval = &EG(uninitialized_zval_ptr); } - zval_ptr_dtor(&object); + if (EXPECTED(*retval != object)) { + zval_ptr_dtor(&object); + } else { + Z_DELREF_P(object); + } } else { if (zobj->ce->__get && guard && guard->in_get == 1) { if (Z_STRVAL_P(member)[0] == '\0') { Modified: php/php-src/trunk/Zend/zend_object_handlers.c =================================================================== --- php/php-src/trunk/Zend/zend_object_handlers.c 2011-04-07 12:36:04 UTC (rev 310008) +++ php/php-src/trunk/Zend/zend_object_handlers.c 2011-04-07 13:35:27 UTC (rev 310009) @@ -446,7 +446,11 @@ } else { retval = &EG(uninitialized_zval_ptr); } - zval_ptr_dtor(&object); + if (EXPECTED(*retval != object)) { + zval_ptr_dtor(&object); + } else { + Z_DELREF_P(object); + } } else { if (zobj->ce->__get && guard && guard->in_get == 1) { if (Z_STRVAL_P(member)[0] == '\0') {
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
