helly Thu Mar 13 19:45:22 2008 UTC Added files: /php-src/ext/spl/tests dit_003.phpt
Modified files: /php-src/ext/spl spl_directory.c Log: - Fix possible memory corruption http://cvs.php.net/viewvc.cgi/php-src/ext/spl/spl_directory.c?r1=1.149&r2=1.150&diff_format=u Index: php-src/ext/spl/spl_directory.c diff -u php-src/ext/spl/spl_directory.c:1.149 php-src/ext/spl/spl_directory.c:1.150 --- php-src/ext/spl/spl_directory.c:1.149 Wed Feb 13 12:01:16 2008 +++ php-src/ext/spl/spl_directory.c Thu Mar 13 19:45:22 2008 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: spl_directory.c,v 1.149 2008/02/13 12:01:16 helly Exp $ */ +/* $Id: spl_directory.c,v 1.150 2008/03/13 19:45:22 helly Exp $ */ #ifdef HAVE_CONFIG_H # include "config.h" @@ -1403,10 +1403,11 @@ static void spl_filesystem_dir_it_dtor(zend_object_iterator *iter TSRMLS_DC) { spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter; + zval *zfree = (zval*)iterator->intern.data; - zval_ptr_dtor(&iterator->current); - zval_ptr_dtor((zval**)&iterator->intern.data); iterator->intern.data = NULL; /* mark as unused */ + zval_ptr_dtor(&iterator->current); + zval_ptr_dtor(&zfree); } /* }}} */ @@ -1469,12 +1470,15 @@ static void spl_filesystem_tree_it_dtor(zend_object_iterator *iter TSRMLS_DC) { spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter; + zval *zfree = (zval*)iterator->intern.data; if (iterator->current) { zval_ptr_dtor(&iterator->current); } - zval_ptr_dtor((zval**)&iterator->intern.data); iterator->intern.data = NULL; /* mark as unused */ + /* free twice as we add ref twice */ + zval_ptr_dtor(&zfree); + zval_ptr_dtor(&zfree); } /* }}} */ @@ -1586,7 +1590,7 @@ dir_object = (spl_filesystem_object*)zend_object_store_get_object(object TSRMLS_CC); iterator = spl_filesystem_object_to_iterator(dir_object); - Z_ADDREF_P(object); + Z_SET_REFCOUNT_P(object, Z_REFCOUNT_P(object) + 2); iterator->intern.data = (void*)object; iterator->intern.funcs = &spl_filesystem_tree_it_funcs; iterator->current = NULL; http://cvs.php.net/viewvc.cgi/php-src/ext/spl/tests/dit_003.phpt?view=markup&rev=1.1 Index: php-src/ext/spl/tests/dit_003.phpt +++ php-src/ext/spl/tests/dit_003.phpt --TEST-- SPL: FilesystemIterator and foreach --SKIPIF-- <?php if (!extension_loaded("spl")) print "skip"; ?> --FILE-- <?php $count = 0; foreach(new FilesystemIterator('CVS') as $ent) { ++$count; } var_dump($count > 0); ?> ===DONE=== --EXPECTF-- bool(true) ===DONE=== -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php