[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/fileinfo/fileinfo.c branches/PHP_5_3/ext/fileinfo/tests/bug61173.phpt trunk/ext/fileinfo/fileinfo.c trunk/ext/fileinfo/tests/bug

2012-02-24 Thread Gustavo André dos Santos Lopes
cataphract   Fri, 24 Feb 2012 10:01:39 +

Revision: http://svn.php.net/viewvc?view=revisionrevision=323472

Log:
- Fixed bug #61173 (Unable to detect error from finfo constructor).
- Tidied up NEWS

Bug: https://bugs.php.net/61173 (Feedback) Unable to detect error from finfo 
constructor
  
Changed paths:
U   php/php-src/branches/PHP_5_3/NEWS
U   php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c
A   php/php-src/branches/PHP_5_3/ext/fileinfo/tests/bug61173.phpt
U   php/php-src/trunk/ext/fileinfo/fileinfo.c
A   php/php-src/trunk/ext/fileinfo/tests/bug61173.phpt

Modified: php/php-src/branches/PHP_5_3/NEWS
===
--- php/php-src/branches/PHP_5_3/NEWS	2012-02-24 10:01:32 UTC (rev 323471)
+++ php/php-src/branches/PHP_5_3/NEWS	2012-02-24 10:01:39 UTC (rev 323472)
@@ -1,22 +1,16 @@
 PHPNEWS
 |||
 ?? ??? 2012, PHP 5.3.11
+
 - Core:
   . Improved max_input_vars directive to check nested variables (Dmitry).
   . Fixed bug #61095 (Incorect lexing of 0x00*+NUM). (Etienne)
-
-- Session:
-  . Fixed bug #60860 (session.save_handler=user without defined function core
-dumps). (Felipe)
-
-- Tidy:
-  . Fixed bug #54682 (tidy null pointer dereference). (Tony, David Soria Parra)
-
-- Core:
   . Fixed bug #61072 (Memory leak when restoring an exception handler).
 (Nikic, Laruence)
-  . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical vars).
-(Laruence)
+  . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX).
+	(Laruence)
+  . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical
+	vars). (Laruence)
   . Fix bug #60895 (Possible invalid handler usage in windows random
 functions). (Pierre)
   . Fixed bug #60825 (Segfault when running symfony 2 tests).
@@ -25,18 +19,12 @@
 (rui, Gustavo)
   . Fixed bug #51860 (Include fails with toplevel symlink to /). (Dmitry)

+- Fileinfo
+  . Fixed bug #61173 (Unable to detect error from finfo constructor). (Gustavo)
+
 - Firebird Database extension (ibase):
   . Fixed bug #60802 (ibase_trans() gives segfault when passing params).

-- Streams:
-  . Fixed bug #61115 (stream related segfault on fatal error in
-php_stream_context_link). (Gustavo)
-  . Further fix for bug #60455 (stream_get_line misbehaves if EOF is not detected
-together with the last read). (Gustavo)
-  . Fixed bug #60817 (stream_get_line() reads from stream even when there is
-already sufficient data buffered). stream_get_line() now behaves more like
-fgets(), as is documented. (Gustavo)
-
 - PHP-FPM SAPI:
   . Fixed bug #60811 (php-fpm compilation problem). (rasmus)

@@ -53,10 +41,22 @@
   . Fixed bug #60968 (Late static binding doesn't work with
 ReflectionMethod::invokeArgs()). (Laruence)

-- Array:
-  . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX).
-(Laruence)
+- Session:
+  . Fixed bug #60860 (session.save_handler=user without defined function core
+dumps). (Felipe)

+- Streams:
+  . Fixed bug #61115 (stream related segfault on fatal error in
+php_stream_context_link). (Gustavo)
+  . Further fix for bug #60455 (stream_get_line misbehaves if EOF is not
+detected together with the last read). (Gustavo)
+  . Fixed bug #60817 (stream_get_line() reads from stream even when there is
+already sufficient data buffered). stream_get_line() now behaves more like
+fgets(), as is documented. (Gustavo)
+
+- Tidy:
+  . Fixed bug #54682 (tidy null pointer dereference). (Tony, David Soria Parra)
+
 - XMLRPC:
   . Fixed bug #61097 (Memory leak in xmlrpc functions copying zvals). (Nikic)


Modified: php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c
===
--- php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c	2012-02-24 10:01:32 UTC (rev 323471)
+++ php/php-src/branches/PHP_5_3/ext/fileinfo/fileinfo.c	2012-02-24 10:01:39 UTC (rev 323472)
@@ -76,9 +76,9 @@
 	} \
 }

-/* {{{ finfo_objects_dtor
+/* {{{ finfo_objects_free
  */
-static void finfo_objects_dtor(void *object, zend_object_handle handle TSRMLS_DC)
+static void finfo_objects_free(void *object TSRMLS_DC)
 {
 	struct finfo_object *intern = (struct finfo_object *) object;

@@ -108,7 +108,8 @@

 	intern-ptr = NULL;

-	retval.handle = zend_objects_store_put(intern, finfo_objects_dtor, NULL, NULL TSRMLS_CC);
+	retval.handle = zend_objects_store_put(intern, NULL,
+		finfo_objects_free, NULL TSRMLS_CC);
 	retval.handlers = (zend_object_handlers *) finfo_object_handlers;

 	return retval;
@@ -276,6 +277,15 @@
 }
 /* }}} */

+#define FILEINFO_DESTROY_OBJECT(object)			\
+	do {		\
+		if (object) {			\
+			zend_object_store_ctor_failed(object TSRMLS_CC);	\
+			zval_dtor(object);	\
+			

[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/ext/standard/streamsfuncs.c branches/PHP_5_3/main/streams/streams.c trunk/ext/standard/streamsfuncs.c trunk/main/streams/streams.c

2012-02-24 Thread Gustavo André dos Santos Lopes
cataphract   Fri, 24 Feb 2012 22:56:21 +

Revision: http://svn.php.net/viewvc?view=revisionrevision=323478

Log:
- Better fix for #61115.
- Fixed resource leak in stream_socket_client().

Bug: https://bugs.php.net/61115 (Closed) Stream related segfault on fatal error 
in php_stream_context_del_link
  
Changed paths:
U   php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c
U   php/php-src/branches/PHP_5_3/main/streams/streams.c
U   php/php-src/trunk/ext/standard/streamsfuncs.c
U   php/php-src/trunk/main/streams/streams.c

Modified: php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c
===
--- php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c2012-02-24 
20:11:11 UTC (rev 323477)
+++ php/php-src/branches/PHP_5_3/ext/standard/streamsfuncs.c2012-02-24 
22:56:21 UTC (rev 323478)
@@ -106,10 +106,6 @@

context = php_stream_context_from_zval(zcontext, flags  
PHP_FILE_NO_DEFAULT_CONTEXT);

-   if (context) {
-   zend_list_addref(context-rsrc_id);
-   }
-
if (flags  PHP_STREAM_CLIENT_PERSISTENT) {
spprintf(hashkey, 0, stream_socket_client__%s, host);
}

Modified: php/php-src/branches/PHP_5_3/main/streams/streams.c
===
--- php/php-src/branches/PHP_5_3/main/streams/streams.c 2012-02-24 20:11:11 UTC 
(rev 323477)
+++ php/php-src/branches/PHP_5_3/main/streams/streams.c 2012-02-24 22:56:21 UTC 
(rev 323478)
@@ -320,10 +320,15 @@
int remove_rsrc = 1;
int preserve_handle = close_options  PHP_STREAM_FREE_PRESERVE_HANDLE ? 
1 : 0;
int release_cast = 1;
-   /* on an unclean shutdown, the context may have already been freed (if 
it
-* was created after the stream resource), so don't reference it */
-   php_stream_context *context = CG(unclean_shutdown) ? NULL : 
stream-context;
+   php_stream_context *context = NULL;

+   /* on an resource list destruction, the context, another resource, may 
have
+* already been freed (if it was created after the stream resource), so
+* don't reference it */
+   if (!(close_options  PHP_STREAM_FREE_RSRC_DTOR)) {
+   context = stream-context;
+   }
+
if (stream-flags  PHP_STREAM_FLAG_NO_CLOSE) {
preserve_handle = 1;
}

Modified: php/php-src/trunk/ext/standard/streamsfuncs.c
===
--- php/php-src/trunk/ext/standard/streamsfuncs.c   2012-02-24 20:11:11 UTC 
(rev 323477)
+++ php/php-src/trunk/ext/standard/streamsfuncs.c   2012-02-24 22:56:21 UTC 
(rev 323478)
@@ -106,10 +106,6 @@

context = php_stream_context_from_zval(zcontext, flags  
PHP_FILE_NO_DEFAULT_CONTEXT);

-   if (context) {
-   zend_list_addref(context-rsrc_id);
-   }
-
if (flags  PHP_STREAM_CLIENT_PERSISTENT) {
spprintf(hashkey, 0, stream_socket_client__%s, host);
}

Modified: php/php-src/trunk/main/streams/streams.c
===
--- php/php-src/trunk/main/streams/streams.c2012-02-24 20:11:11 UTC (rev 
323477)
+++ php/php-src/trunk/main/streams/streams.c2012-02-24 22:56:21 UTC (rev 
323478)
@@ -366,10 +366,15 @@
int ret = 1;
int preserve_handle = close_options  PHP_STREAM_FREE_PRESERVE_HANDLE ? 
1 : 0;
int release_cast = 1;
-   /* on an unclean shutdown, the context may have already been freed (if 
it
-* was created after the stream resource), so don't reference it */
-   php_stream_context *context = CG(unclean_shutdown) ? NULL : 
stream-context;
+   php_stream_context *context = NULL;

+   /* on an resource list destruction, the context, another resource, may 
have
+* already been freed (if it was created after the stream resource), so
+* don't reference it */
+   if (!(close_options  PHP_STREAM_FREE_RSRC_DTOR)) {
+   context = stream-context;
+   }
+
if (stream-flags  PHP_STREAM_FLAG_NO_CLOSE) {
preserve_handle = 1;
}

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-CVS] svn: /php/php-src/trunk/Zend/tests/ bug61165.phpt

2012-02-24 Thread Xinchen Hui
laruence Sat, 25 Feb 2012 03:12:54 +

Revision: http://svn.php.net/viewvc?view=revisionrevision=323485

Log:
Tests for bug #61165

Bug: https://bugs.php.net/61165 (Assigned) Segfault - strip_tags()
  
Changed paths:
A   php/php-src/trunk/Zend/tests/bug61165.phpt

Added: php/php-src/trunk/Zend/tests/bug61165.phpt
===
--- php/php-src/trunk/Zend/tests/bug61165.phpt  (rev 0)
+++ php/php-src/trunk/Zend/tests/bug61165.phpt  2012-02-25 03:12:54 UTC (rev 
323485)
@@ -0,0 +1,30 @@
+--TEST--
+Bug #61165 (Segfault - strip_tags())
+--XFAILD--
+#61165 doesn't fix yet
+--FILE--
+?php
+
+$handler = NULL;
+class T {
+public $_this;
+
+public function __toString() {
+   global $handler;
+   $handler = $this;
+$this-_this = $this; // -- uncoment this
+return 'A';
+}
+}
+
+$t = new T;
+for ($i = 0; $i  3; $i++) {
+strip_tags($t);
+   strip_tags(new T);
+echo $i\n;
+}
+--EXPECTF--
+object(T)#%d (1) {
+  [_this]=
+  *RECURSION*
+}

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-CVS] svn: /php/php-src/trunk/Zend/tests/ bug61011.phpt bug61165.phpt

2012-02-24 Thread Xinchen Hui
laruence Sat, 25 Feb 2012 03:16:28 +

Revision: http://svn.php.net/viewvc?view=revisionrevision=323487

Log:
typo

Changed paths:
U   php/php-src/trunk/Zend/tests/bug61011.phpt
U   php/php-src/trunk/Zend/tests/bug61165.phpt

Modified: php/php-src/trunk/Zend/tests/bug61011.phpt
===
--- php/php-src/trunk/Zend/tests/bug61011.phpt  2012-02-25 03:14:16 UTC (rev 
323486)
+++ php/php-src/trunk/Zend/tests/bug61011.phpt  2012-02-25 03:16:28 UTC (rev 
323487)
@@ -1,6 +1,6 @@
 --TEST--
 Bug #61011 (Crash when an exception is thrown by __autoload accessing a static 
property)
---XFAILD--
+--XFAIL--
 #61011 have not been fixed yet
 --FILE--
 ?php

Modified: php/php-src/trunk/Zend/tests/bug61165.phpt
===
--- php/php-src/trunk/Zend/tests/bug61165.phpt  2012-02-25 03:14:16 UTC (rev 
323486)
+++ php/php-src/trunk/Zend/tests/bug61165.phpt  2012-02-25 03:16:28 UTC (rev 
323487)
@@ -1,6 +1,6 @@
 --TEST--
 Bug #61165 (Segfault - strip_tags())
---XFAILD--
+--XFAIL--
 #61165 doesn't fix yet
 --FILE--
 ?php

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-CVS] svn: /php/php-src/trunk/Zend/tests/ bug61165.phpt

2012-02-24 Thread Xinchen Hui
laruence Sat, 25 Feb 2012 03:19:27 +

Revision: http://svn.php.net/viewvc?view=revisionrevision=323488

Log:
Fix test

Changed paths:
U   php/php-src/trunk/Zend/tests/bug61165.phpt

Modified: php/php-src/trunk/Zend/tests/bug61165.phpt
===
--- php/php-src/trunk/Zend/tests/bug61165.phpt  2012-02-25 03:16:28 UTC (rev 
323487)
+++ php/php-src/trunk/Zend/tests/bug61165.phpt  2012-02-25 03:19:27 UTC (rev 
323488)
@@ -21,8 +21,8 @@
 for ($i = 0; $i  3; $i++) {
 strip_tags($t);
strip_tags(new T);
-echo $i\n;
 }
+var_dump($handler);
 --EXPECTF--
 object(T)#%d (1) {
   [_this]=

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/Zend/zend_API.c trunk/NEWS trunk/Zend/zend_API.c

2012-02-24 Thread Xinchen Hui
laruence Sat, 25 Feb 2012 04:36:08 +

Revision: http://svn.php.net/viewvc?view=revisionrevision=323489

Log:
Fixed bug #61165 (Segfault - strip_tags())

Bug: https://bugs.php.net/61165 (Assigned) Segfault - strip_tags()
  
Changed paths:
U   php/php-src/branches/PHP_5_3/NEWS
U   php/php-src/branches/PHP_5_3/Zend/zend_API.c
U   php/php-src/trunk/NEWS
U   php/php-src/trunk/Zend/zend_API.c

Modified: php/php-src/branches/PHP_5_3/NEWS
===
--- php/php-src/branches/PHP_5_3/NEWS   2012-02-25 03:19:27 UTC (rev 323488)
+++ php/php-src/branches/PHP_5_3/NEWS   2012-02-25 04:36:08 UTC (rev 323489)
@@ -3,6 +3,7 @@
 ?? ??? 2012, PHP 5.3.11

 - Core:
+  . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
   . Improved max_input_vars directive to check nested variables (Dmitry).
   . Fixed bug #61095 (Incorect lexing of 0x00*+NUM). (Etienne)
   . Fixed bug #61072 (Memory leak when restoring an exception handler).

Modified: php/php-src/branches/PHP_5_3/Zend/zend_API.c
===
--- php/php-src/branches/PHP_5_3/Zend/zend_API.c2012-02-25 03:19:27 UTC 
(rev 323488)
+++ php/php-src/branches/PHP_5_3/Zend/zend_API.c2012-02-25 04:36:08 UTC 
(rev 323489)
@@ -254,10 +254,15 @@
 static int parse_arg_object_to_string(zval **arg TSRMLS_DC) /* {{{ */
 {
if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
-   SEPARATE_ZVAL_IF_NOT_REF(arg);
-   if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, IS_STRING 
TSRMLS_CC) == SUCCESS) {
+   zval *obj;
+   ALLOC_ZVAL(obj);
+   MAKE_COPY_ZVAL(arg, obj);
+   if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, IS_STRING 
TSRMLS_CC) == SUCCESS) {
+   zval_ptr_dtor(arg);
+   *arg = obj;
return SUCCESS;
}
+   zval_ptr_dtor(obj);
}
/* Standard PHP objects */
if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, 
cast_object)) {

Modified: php/php-src/trunk/NEWS
===
--- php/php-src/trunk/NEWS  2012-02-25 03:19:27 UTC (rev 323488)
+++ php/php-src/trunk/NEWS  2012-02-25 04:36:08 UTC (rev 323489)
@@ -6,6 +6,7 @@
   . World domination

 - Core:
+  . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
   . Fixed bug #61072 (Memory leak when restoring an exception handler).
 (Nikic, Laruence)
   . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical

Modified: php/php-src/trunk/Zend/zend_API.c
===
--- php/php-src/trunk/Zend/zend_API.c   2012-02-25 03:19:27 UTC (rev 323488)
+++ php/php-src/trunk/Zend/zend_API.c   2012-02-25 04:36:08 UTC (rev 323489)
@@ -262,12 +262,17 @@
 static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type 
TSRMLS_DC) /* {{{ */
 {
if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
-   SEPARATE_ZVAL_IF_NOT_REF(arg);
-   if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type 
TSRMLS_CC) == SUCCESS) {
+   zval *obj;
+   ALLOC_ZVAL(obj);
+   MAKE_COPY_ZVAL(arg, obj);
+   if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, type 
TSRMLS_CC) == SUCCESS) {
+   zval_ptr_dtor(arg);
+   *arg = obj;
*pl = Z_STRLEN_PP(arg);
*p = Z_STRVAL_PP(arg);
return SUCCESS;
}
+   zval_ptr_dtor(obj);
}
/* Standard PHP objects */
if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, 
cast_object)) {

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/Zend/zend_API.c trunk/NEWS trunk/Zend/zend_API.c

2012-02-24 Thread Laruence
Dmitry:
   you might want to review this fix.

   let me explain why crash before this fix.

   when doing parse_parameter,  then convert the object to string by
calling the ce-cast_object,

   and passed the same pointer(although there was a separation), to
the cast_object..

   then if __toString method stash $this somewhere, after the
parameters clean up,  the $this pointer will be impending..

   then in the next loop, the return_value will happen used the same adress,,

   then balalala, cause the segfault..

   sorry for my poor english,  and hope I have made myself clearly,
if there is any question , plz write me.

thanks

On Sat, Feb 25, 2012 at 12:36 PM, Xinchen Hui larue...@php.net wrote:
 laruence                                 Sat, 25 Feb 2012 04:36:08 +

 Revision: http://svn.php.net/viewvc?view=revisionrevision=323489

 Log:
 Fixed bug #61165 (Segfault - strip_tags())

 Bug: https://bugs.php.net/61165 (Assigned) Segfault - strip_tags()

 Changed paths:
    U   php/php-src/branches/PHP_5_3/NEWS
    U   php/php-src/branches/PHP_5_3/Zend/zend_API.c
    U   php/php-src/trunk/NEWS
    U   php/php-src/trunk/Zend/zend_API.c

 Modified: php/php-src/branches/PHP_5_3/NEWS
 ===
 --- php/php-src/branches/PHP_5_3/NEWS   2012-02-25 03:19:27 UTC (rev 323488)
 +++ php/php-src/branches/PHP_5_3/NEWS   2012-02-25 04:36:08 UTC (rev 323489)
 @@ -3,6 +3,7 @@
  ?? ??? 2012, PHP 5.3.11

  - Core:
 +  . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
   . Improved max_input_vars directive to check nested variables (Dmitry).
   . Fixed bug #61095 (Incorect lexing of 0x00*+NUM). (Etienne)
   . Fixed bug #61072 (Memory leak when restoring an exception handler).

 Modified: php/php-src/branches/PHP_5_3/Zend/zend_API.c
 ===
 --- php/php-src/branches/PHP_5_3/Zend/zend_API.c        2012-02-25 03:19:27 
 UTC (rev 323488)
 +++ php/php-src/branches/PHP_5_3/Zend/zend_API.c        2012-02-25 04:36:08 
 UTC (rev 323489)
 @@ -254,10 +254,15 @@
  static int parse_arg_object_to_string(zval **arg TSRMLS_DC) /* {{{ */
  {
        if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
 -               SEPARATE_ZVAL_IF_NOT_REF(arg);
 -               if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, IS_STRING 
 TSRMLS_CC) == SUCCESS) {
 +               zval *obj;
 +               ALLOC_ZVAL(obj);
 +               MAKE_COPY_ZVAL(arg, obj);
 +               if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, IS_STRING 
 TSRMLS_CC) == SUCCESS) {
 +                       zval_ptr_dtor(arg);
 +                       *arg = obj;
                        return SUCCESS;
                }
 +               zval_ptr_dtor(obj);
        }
        /* Standard PHP objects */
        if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, 
 cast_object)) {

 Modified: php/php-src/trunk/NEWS
 ===
 --- php/php-src/trunk/NEWS      2012-02-25 03:19:27 UTC (rev 323488)
 +++ php/php-src/trunk/NEWS      2012-02-25 04:36:08 UTC (rev 323489)
 @@ -6,6 +6,7 @@
   . World domination

  - Core:
 +  . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
   . Fixed bug #61072 (Memory leak when restoring an exception handler).
     (Nikic, Laruence)
   . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical

 Modified: php/php-src/trunk/Zend/zend_API.c
 ===
 --- php/php-src/trunk/Zend/zend_API.c   2012-02-25 03:19:27 UTC (rev 323488)
 +++ php/php-src/trunk/Zend/zend_API.c   2012-02-25 04:36:08 UTC (rev 323489)
 @@ -262,12 +262,17 @@
  static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int 
 type TSRMLS_DC) /* {{{ */
  {
        if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
 -               SEPARATE_ZVAL_IF_NOT_REF(arg);
 -               if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type 
 TSRMLS_CC) == SUCCESS) {
 +               zval *obj;
 +               ALLOC_ZVAL(obj);
 +               MAKE_COPY_ZVAL(arg, obj);
 +               if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, type 
 TSRMLS_CC) == SUCCESS) {
 +                       zval_ptr_dtor(arg);
 +                       *arg = obj;
                        *pl = Z_STRLEN_PP(arg);
                        *p = Z_STRVAL_PP(arg);
                        return SUCCESS;
                }
 +               zval_ptr_dtor(obj);
        }
        /* Standard PHP objects */
        if (Z_OBJ_HT_PP(arg) == std_object_handlers || !Z_OBJ_HANDLER_PP(arg, 
 cast_object)) {


 --
 PHP CVS Mailing List (http://www.php.net/)
 To unsubscribe, visit: http://www.php.net/unsub.php



-- 
Laruence  Xinchen Hui
http://www.laruence.com/

--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[PHP-CVS] svn: /php/php-src/ branches/PHP_5_3/Zend/tests/bug61165.phpt trunk/Zend/tests/bug61165.phpt

2012-02-24 Thread Xinchen Hui
laruence Sat, 25 Feb 2012 05:18:40 +

Revision: http://svn.php.net/viewvc?view=revisionrevision=323490

Log:
merge test to 5.3, and remove xfail since the bug was fixed

Changed paths:
A   php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt
U   php/php-src/trunk/Zend/tests/bug61165.phpt

Added: php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt
===
--- php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt   
(rev 0)
+++ php/php-src/branches/PHP_5_3/Zend/tests/bug61165.phpt   2012-02-25 
05:18:40 UTC (rev 323490)
@@ -0,0 +1,28 @@
+--TEST--
+Bug #61165 (Segfault - strip_tags())
+--FILE--
+?php
+
+$handler = NULL;
+class T {
+public $_this;
+
+public function __toString() {
+   global $handler;
+   $handler = $this;
+$this-_this = $this; // -- uncoment this
+return 'A';
+}
+}
+
+$t = new T;
+for ($i = 0; $i  3; $i++) {
+strip_tags($t);
+   strip_tags(new T);
+}
+var_dump($handler);
+--EXPECTF--
+object(T)#%d (1) {
+  [_this]=
+  *RECURSION*
+}

Modified: php/php-src/trunk/Zend/tests/bug61165.phpt
===
--- php/php-src/trunk/Zend/tests/bug61165.phpt  2012-02-25 04:36:08 UTC (rev 
323489)
+++ php/php-src/trunk/Zend/tests/bug61165.phpt  2012-02-25 05:18:40 UTC (rev 
323490)
@@ -1,7 +1,5 @@
 --TEST--
 Bug #61165 (Segfault - strip_tags())
---XFAIL--
-#61165 doesn't fix yet
 --FILE--
 ?php


-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php