[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/fileinfo/fileinfo.c branches/PHP_5_3/ext/fileinfo/tests/bug61173.phpt trunk/ext/fileinfo/fileinfo.c trunk/ext/fileinfo/tests/bug
cataphract Fri, 24 Feb 2012 10:01:39 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323472 Log: - Fixed bug #61173 (Unable to detect error from finfo constructor). - Tidied up NEWS Bug: https://bugs.php.net/61173 (Feedback) Unable to detect error from finfo constructor Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c A php/php-src/branches/PHP_5_3/ext/fileinfo/tests/bug61173.phpt U php/php-src/trunk/ext/fileinfo/fileinfo.c A php/php-src/trunk/ext/fileinfo/tests/bug61173.phpt Modified: php/php-src/branches/PHP_5_3/NEWS === --- php/php-src/branches/PHP_5_3/NEWS 2012-02-24 10:01:32 UTC (rev 323471) +++ php/php-src/branches/PHP_5_3/NEWS 2012-02-24 10:01:39 UTC (rev 323472) @@ -1,22 +1,16 @@ PHPNEWS ||| ?? ??? 2012, PHP 5.3.11 + - Core: . Improved max_input_vars directive to check nested variables (Dmitry). . Fixed bug #61095 (Incorect lexing of 0x00*+NUM). (Etienne) - -- Session: - . Fixed bug #60860 (session.save_handler=user without defined function core -dumps). (Felipe) - -- Tidy: - . Fixed bug #54682 (tidy null pointer dereference). (Tony, David Soria Parra) - -- Core: . Fixed bug #61072 (Memory leak when restoring an exception handler). (Nikic, Laruence) - . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical vars). -(Laruence) + . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX). + (Laruence) + . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical + vars). (Laruence) . Fix bug #60895 (Possible invalid handler usage in windows random functions). (Pierre) . Fixed bug #60825 (Segfault when running symfony 2 tests). @@ -25,18 +19,12 @@ (rui, Gustavo) . Fixed bug #51860 (Include fails with toplevel symlink to /). (Dmitry) +- Fileinfo + . Fixed bug #61173 (Unable to detect error from finfo constructor). (Gustavo) + - Firebird Database extension (ibase): . Fixed bug #60802 (ibase_trans() gives segfault when passing params). -- Streams: - . Fixed bug #61115 (stream related segfault on fatal error in -php_stream_context_link). (Gustavo) - . Further fix for bug #60455 (stream_get_line misbehaves if EOF is not detected -together with the last read). (Gustavo) - . Fixed bug #60817 (stream_get_line() reads from stream even when there is -already sufficient data buffered). stream_get_line() now behaves more like -fgets(), as is documented. (Gustavo) - - PHP-FPM SAPI: . Fixed bug #60811 (php-fpm compilation problem). (rasmus) @@ -53,10 +41,22 @@ . Fixed bug #60968 (Late static binding doesn't work with ReflectionMethod::invokeArgs()). (Laruence) -- Array: - . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX). -(Laruence) +- Session: + . Fixed bug #60860 (session.save_handler=user without defined function core +dumps). (Felipe) +- Streams: + . Fixed bug #61115 (stream related segfault on fatal error in +php_stream_context_link). (Gustavo) + . Further fix for bug #60455 (stream_get_line misbehaves if EOF is not +detected together with the last read). (Gustavo) + . Fixed bug #60817 (stream_get_line() reads from stream even when there is +already sufficient data buffered). stream_get_line() now behaves more like +fgets(), as is documented. (Gustavo) + +- Tidy: + . Fixed bug #54682 (tidy null pointer dereference). (Tony, David Soria Parra) + - XMLRPC: . Fixed bug #61097 (Memory leak in xmlrpc functions copying zvals). (Nikic) Modified: php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c === --- php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c 2012-02-24 10:01:32 UTC (rev 323471) +++ php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c 2012-02-24 10:01:39 UTC (rev 323472) @@ -76,9 +76,9 @@ } \ } -/* {{{ finfo_objects_dtor +/* {{{ finfo_objects_free */ -static void finfo_objects_dtor(void *object, zend_object_handle handle TSRMLS_DC) +static void finfo_objects_free(void *object TSRMLS_DC) { struct finfo_object *intern = (struct finfo_object *) object; @@ -108,7 +108,8 @@ intern-ptr = NULL; - retval.handle = zend_objects_store_put(intern, finfo_objects_dtor, NULL, NULL TSRMLS_CC); + retval.handle = zend_objects_store_put(intern, NULL, + finfo_objects_free, NULL TSRMLS_CC); retval.handlers = (zend_object_handlers *) finfo_object_handlers; return retval; @@ -276,6 +277,15 @@ } /* }}} */ +#define FILEINFO_DESTROY_OBJECT(object) \ + do { \ + if (object) { \ + zend_object_store_ctor_failed(object TSRMLS_CC); \ + zval_dtor(object); \ +
[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/ext/standard/streamsfuncs.c branches/PHP_5_3/main/streams/streams.c trunk/ext/standard/streamsfuncs.c trunk/main/streams/streams.c
cataphract Fri, 24 Feb 2012 22:56:21 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323478 Log: - Better fix for #61115. - Fixed resource leak in stream_socket_client(). Bug: https://bugs.php.net/61115 (Closed) Stream related segfault on fatal error in php_stream_context_del_link Changed paths: U php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c U php/php-src/branches/PHP_5_3/main/streams/streams.c U php/php-src/trunk/ext/standard/streamsfuncs.c U php/php-src/trunk/main/streams/streams.c Modified: php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c === --- php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c2012-02-24 20:11:11 UTC (rev 323477) +++ php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c2012-02-24 22:56:21 UTC (rev 323478) @@ -106,10 +106,6 @@ context = php_stream_context_from_zval(zcontext, flags PHP_FILE_NO_DEFAULT_CONTEXT); - if (context) { - zend_list_addref(context-rsrc_id); - } - if (flags PHP_STREAM_CLIENT_PERSISTENT) { spprintf(hashkey, 0, stream_socket_client__%s, host); } Modified: php/php-src/branches/PHP_5_3/main/streams/streams.c === --- php/php-src/branches/PHP_5_3/main/streams/streams.c 2012-02-24 20:11:11 UTC (rev 323477) +++ php/php-src/branches/PHP_5_3/main/streams/streams.c 2012-02-24 22:56:21 UTC (rev 323478) @@ -320,10 +320,15 @@ int remove_rsrc = 1; int preserve_handle = close_options PHP_STREAM_FREE_PRESERVE_HANDLE ? 1 : 0; int release_cast = 1; - /* on an unclean shutdown, the context may have already been freed (if it -* was created after the stream resource), so don't reference it */ - php_stream_context *context = CG(unclean_shutdown) ? NULL : stream-context; + php_stream_context *context = NULL; + /* on an resource list destruction, the context, another resource, may have +* already been freed (if it was created after the stream resource), so +* don't reference it */ + if (!(close_options PHP_STREAM_FREE_RSRC_DTOR)) { + context = stream-context; + } + if (stream-flags PHP_STREAM_FLAG_NO_CLOSE) { preserve_handle = 1; } Modified: php/php-src/trunk/ext/standard/streamsfuncs.c === --- php/php-src/trunk/ext/standard/streamsfuncs.c 2012-02-24 20:11:11 UTC (rev 323477) +++ php/php-src/trunk/ext/standard/streamsfuncs.c 2012-02-24 22:56:21 UTC (rev 323478) @@ -106,10 +106,6 @@ context = php_stream_context_from_zval(zcontext, flags PHP_FILE_NO_DEFAULT_CONTEXT); - if (context) { - zend_list_addref(context-rsrc_id); - } - if (flags PHP_STREAM_CLIENT_PERSISTENT) { spprintf(hashkey, 0, stream_socket_client__%s, host); } Modified: php/php-src/trunk/main/streams/streams.c === --- php/php-src/trunk/main/streams/streams.c2012-02-24 20:11:11 UTC (rev 323477) +++ php/php-src/trunk/main/streams/streams.c2012-02-24 22:56:21 UTC (rev 323478) @@ -366,10 +366,15 @@ int ret = 1; int preserve_handle = close_options PHP_STREAM_FREE_PRESERVE_HANDLE ? 1 : 0; int release_cast = 1; - /* on an unclean shutdown, the context may have already been freed (if it -* was created after the stream resource), so don't reference it */ - php_stream_context *context = CG(unclean_shutdown) ? NULL : stream-context; + php_stream_context *context = NULL; + /* on an resource list destruction, the context, another resource, may have +* already been freed (if it was created after the stream resource), so +* don't reference it */ + if (!(close_options PHP_STREAM_FREE_RSRC_DTOR)) { + context = stream-context; + } + if (stream-flags PHP_STREAM_FLAG_NO_CLOSE) { preserve_handle = 1; } -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-CVS] svn: /php/php-src/trunk/Zend/tests/ bug61165.phpt
laruence Sat, 25 Feb 2012 03:12:54 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323485 Log: Tests for bug #61165 Bug: https://bugs.php.net/61165 (Assigned) Segfault - strip_tags() Changed paths: A php/php-src/trunk/Zend/tests/bug61165.phpt Added: php/php-src/trunk/Zend/tests/bug61165.phpt === --- php/php-src/trunk/Zend/tests/bug61165.phpt (rev 0) +++ php/php-src/trunk/Zend/tests/bug61165.phpt 2012-02-25 03:12:54 UTC (rev 323485) @@ -0,0 +1,30 @@ +--TEST-- +Bug #61165 (Segfault - strip_tags()) +--XFAILD-- +#61165 doesn't fix yet +--FILE-- +?php + +$handler = NULL; +class T { +public $_this; + +public function __toString() { + global $handler; + $handler = $this; +$this-_this = $this; // -- uncoment this +return 'A'; +} +} + +$t = new T; +for ($i = 0; $i 3; $i++) { +strip_tags($t); + strip_tags(new T); +echo $i\n; +} +--EXPECTF-- +object(T)#%d (1) { + [_this]= + *RECURSION* +} -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-CVS] svn: /php/php-src/trunk/Zend/tests/ bug61011.phpt bug61165.phpt
laruence Sat, 25 Feb 2012 03:16:28 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323487 Log: typo Changed paths: U php/php-src/trunk/Zend/tests/bug61011.phpt U php/php-src/trunk/Zend/tests/bug61165.phpt Modified: php/php-src/trunk/Zend/tests/bug61011.phpt === --- php/php-src/trunk/Zend/tests/bug61011.phpt 2012-02-25 03:14:16 UTC (rev 323486) +++ php/php-src/trunk/Zend/tests/bug61011.phpt 2012-02-25 03:16:28 UTC (rev 323487) @@ -1,6 +1,6 @@ --TEST-- Bug #61011 (Crash when an exception is thrown by __autoload accessing a static property) ---XFAILD-- +--XFAIL-- #61011 have not been fixed yet --FILE-- ?php Modified: php/php-src/trunk/Zend/tests/bug61165.phpt === --- php/php-src/trunk/Zend/tests/bug61165.phpt 2012-02-25 03:14:16 UTC (rev 323486) +++ php/php-src/trunk/Zend/tests/bug61165.phpt 2012-02-25 03:16:28 UTC (rev 323487) @@ -1,6 +1,6 @@ --TEST-- Bug #61165 (Segfault - strip_tags()) ---XFAILD-- +--XFAIL-- #61165 doesn't fix yet --FILE-- ?php -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-CVS] svn: /php/php-src/trunk/Zend/tests/ bug61165.phpt
laruence Sat, 25 Feb 2012 03:19:27 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323488 Log: Fix test Changed paths: U php/php-src/trunk/Zend/tests/bug61165.phpt Modified: php/php-src/trunk/Zend/tests/bug61165.phpt === --- php/php-src/trunk/Zend/tests/bug61165.phpt 2012-02-25 03:16:28 UTC (rev 323487) +++ php/php-src/trunk/Zend/tests/bug61165.phpt 2012-02-25 03:19:27 UTC (rev 323488) @@ -21,8 +21,8 @@ for ($i = 0; $i 3; $i++) { strip_tags($t); strip_tags(new T); -echo $i\n; } +var_dump($handler); --EXPECTF-- object(T)#%d (1) { [_this]= -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/Zend/zend_API.c trunk/NEWS trunk/Zend/zend_API.c
laruence Sat, 25 Feb 2012 04:36:08 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323489 Log: Fixed bug #61165 (Segfault - strip_tags()) Bug: https://bugs.php.net/61165 (Assigned) Segfault - strip_tags() Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/Zend/zend_API.c U php/php-src/trunk/NEWS U php/php-src/trunk/Zend/zend_API.c Modified: php/php-src/branches/PHP_5_3/NEWS === --- php/php-src/branches/PHP_5_3/NEWS 2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/branches/PHP_5_3/NEWS 2012-02-25 04:36:08 UTC (rev 323489) @@ -3,6 +3,7 @@ ?? ??? 2012, PHP 5.3.11 - Core: + . Fixed bug #61165 (Segfault - strip_tags()). (Laruence) . Improved max_input_vars directive to check nested variables (Dmitry). . Fixed bug #61095 (Incorect lexing of 0x00*+NUM). (Etienne) . Fixed bug #61072 (Memory leak when restoring an exception handler). Modified: php/php-src/branches/PHP_5_3/Zend/zend_API.c === --- php/php-src/branches/PHP_5_3/Zend/zend_API.c2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/branches/PHP_5_3/Zend/zend_API.c2012-02-25 04:36:08 UTC (rev 323489) @@ -254,10 +254,15 @@ static int parse_arg_object_to_string(zval **arg TSRMLS_DC) /* {{{ */ { if (Z_OBJ_HANDLER_PP(arg, cast_object)) { - SEPARATE_ZVAL_IF_NOT_REF(arg); - if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, IS_STRING TSRMLS_CC) == SUCCESS) { + zval *obj; + ALLOC_ZVAL(obj); + MAKE_COPY_ZVAL(arg, obj); + if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, IS_STRING TSRMLS_CC) == SUCCESS) { + zval_ptr_dtor(arg); + *arg = obj; return SUCCESS; } + zval_ptr_dtor(obj); } /* Standard PHP objects */ if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) { Modified: php/php-src/trunk/NEWS === --- php/php-src/trunk/NEWS 2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/trunk/NEWS 2012-02-25 04:36:08 UTC (rev 323489) @@ -6,6 +6,7 @@ . World domination - Core: + . Fixed bug #61165 (Segfault - strip_tags()). (Laruence) . Fixed bug #61072 (Memory leak when restoring an exception handler). (Nikic, Laruence) . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical Modified: php/php-src/trunk/Zend/zend_API.c === --- php/php-src/trunk/Zend/zend_API.c 2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/trunk/Zend/zend_API.c 2012-02-25 04:36:08 UTC (rev 323489) @@ -262,12 +262,17 @@ static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type TSRMLS_DC) /* {{{ */ { if (Z_OBJ_HANDLER_PP(arg, cast_object)) { - SEPARATE_ZVAL_IF_NOT_REF(arg); - if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type TSRMLS_CC) == SUCCESS) { + zval *obj; + ALLOC_ZVAL(obj); + MAKE_COPY_ZVAL(arg, obj); + if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, type TSRMLS_CC) == SUCCESS) { + zval_ptr_dtor(arg); + *arg = obj; *pl = Z_STRLEN_PP(arg); *p = Z_STRVAL_PP(arg); return SUCCESS; } + zval_ptr_dtor(obj); } /* Standard PHP objects */ if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) { -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/Zend/zend_API.c trunk/NEWS trunk/Zend/zend_API.c
Dmitry: you might want to review this fix. let me explain why crash before this fix. when doing parse_parameter, then convert the object to string by calling the ce-cast_object, and passed the same pointer(although there was a separation), to the cast_object.. then if __toString method stash $this somewhere, after the parameters clean up, the $this pointer will be impending.. then in the next loop, the return_value will happen used the same adress,, then balalala, cause the segfault.. sorry for my poor english, and hope I have made myself clearly, if there is any question , plz write me. thanks On Sat, Feb 25, 2012 at 12:36 PM, Xinchen Hui larue...@php.net wrote: laruence Sat, 25 Feb 2012 04:36:08 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323489 Log: Fixed bug #61165 (Segfault - strip_tags()) Bug: https://bugs.php.net/61165 (Assigned) Segfault - strip_tags() Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/Zend/zend_API.c U php/php-src/trunk/NEWS U php/php-src/trunk/Zend/zend_API.c Modified: php/php-src/branches/PHP_5_3/NEWS === --- php/php-src/branches/PHP_5_3/NEWS 2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/branches/PHP_5_3/NEWS 2012-02-25 04:36:08 UTC (rev 323489) @@ -3,6 +3,7 @@ ?? ??? 2012, PHP 5.3.11 - Core: + . Fixed bug #61165 (Segfault - strip_tags()). (Laruence) . Improved max_input_vars directive to check nested variables (Dmitry). . Fixed bug #61095 (Incorect lexing of 0x00*+NUM). (Etienne) . Fixed bug #61072 (Memory leak when restoring an exception handler). Modified: php/php-src/branches/PHP_5_3/Zend/zend_API.c === --- php/php-src/branches/PHP_5_3/Zend/zend_API.c 2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/branches/PHP_5_3/Zend/zend_API.c 2012-02-25 04:36:08 UTC (rev 323489) @@ -254,10 +254,15 @@ static int parse_arg_object_to_string(zval **arg TSRMLS_DC) /* {{{ */ { if (Z_OBJ_HANDLER_PP(arg, cast_object)) { - SEPARATE_ZVAL_IF_NOT_REF(arg); - if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, IS_STRING TSRMLS_CC) == SUCCESS) { + zval *obj; + ALLOC_ZVAL(obj); + MAKE_COPY_ZVAL(arg, obj); + if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, IS_STRING TSRMLS_CC) == SUCCESS) { + zval_ptr_dtor(arg); + *arg = obj; return SUCCESS; } + zval_ptr_dtor(obj); } /* Standard PHP objects */ if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) { Modified: php/php-src/trunk/NEWS === --- php/php-src/trunk/NEWS 2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/trunk/NEWS 2012-02-25 04:36:08 UTC (rev 323489) @@ -6,6 +6,7 @@ . World domination - Core: + . Fixed bug #61165 (Segfault - strip_tags()). (Laruence) . Fixed bug #61072 (Memory leak when restoring an exception handler). (Nikic, Laruence) . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical Modified: php/php-src/trunk/Zend/zend_API.c === --- php/php-src/trunk/Zend/zend_API.c 2012-02-25 03:19:27 UTC (rev 323488) +++ php/php-src/trunk/Zend/zend_API.c 2012-02-25 04:36:08 UTC (rev 323489) @@ -262,12 +262,17 @@ static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type TSRMLS_DC) /* {{{ */ { if (Z_OBJ_HANDLER_PP(arg, cast_object)) { - SEPARATE_ZVAL_IF_NOT_REF(arg); - if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type TSRMLS_CC) == SUCCESS) { + zval *obj; + ALLOC_ZVAL(obj); + MAKE_COPY_ZVAL(arg, obj); + if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, type TSRMLS_CC) == SUCCESS) { + zval_ptr_dtor(arg); + *arg = obj; *pl = Z_STRLEN_PP(arg); *p = Z_STRVAL_PP(arg); return SUCCESS; } + zval_ptr_dtor(obj); } /* Standard PHP objects */ if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) { -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- Laruence Xinchen Hui http://www.laruence.com/ -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/Zend/tests/bug61165.phpt trunk/Zend/tests/bug61165.phpt
laruence Sat, 25 Feb 2012 05:18:40 + Revision: http://svn.php.net/viewvc?view=revisionrevision=323490 Log: merge test to 5.3, and remove xfail since the bug was fixed Changed paths: A php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt U php/php-src/trunk/Zend/tests/bug61165.phpt Added: php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt === --- php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt 2012-02-25 05:18:40 UTC (rev 323490) @@ -0,0 +1,28 @@ +--TEST-- +Bug #61165 (Segfault - strip_tags()) +--FILE-- +?php + +$handler = NULL; +class T { +public $_this; + +public function __toString() { + global $handler; + $handler = $this; +$this-_this = $this; // -- uncoment this +return 'A'; +} +} + +$t = new T; +for ($i = 0; $i 3; $i++) { +strip_tags($t); + strip_tags(new T); +} +var_dump($handler); +--EXPECTF-- +object(T)#%d (1) { + [_this]= + *RECURSION* +} Modified: php/php-src/trunk/Zend/tests/bug61165.phpt === --- php/php-src/trunk/Zend/tests/bug61165.phpt 2012-02-25 04:36:08 UTC (rev 323489) +++ php/php-src/trunk/Zend/tests/bug61165.phpt 2012-02-25 05:18:40 UTC (rev 323490) @@ -1,7 +1,5 @@ --TEST-- Bug #61165 (Segfault - strip_tags()) ---XFAIL-- -#61165 doesn't fix yet --FILE-- ?php -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php