Fixed bug #54372 (Crash accessing global object itself returned from its __get()...

diff --git a/NEWS b/NEWS
index eaaff7952039e4f54d59f4e4bc7b56fabce1ee61..801611684f2a57a47c1d5e6cf7eb8387d35b59cd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 - Zend Engine:
   . Fixed bug #54423 (classes from dl()'ed extensions are not destroyed). 
     (Tony, Dmitry)
+  . Fixed bug #54372 (Crash accessing global object itself returned from its
+    __get() handle). (Dmitry)
   . Fixed bug #54262 (Crash when assigning value to a dimension in a non-array).
     (Dmitry)
 

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index ac373aeb6f30daecfed77424753d409e3ec9731e..2fd097b66271823f9dbc506dcdc9f270dd5521de 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -374,7 +374,11 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /*
                        } else {
                                retval = &EG(uninitialized_zval_ptr);
                        }
-                       zval_ptr_dtor(&object);
+                       if (EXPECTED(*retval != object)) {
+                               zval_ptr_dtor(&object);
+                       } else {
+                               Z_DELREF_P(object);
+                       }
                } else {
                        if (zobj->ce->__get && guard && guard->in_get == 1) {
                                if (Z_STRVAL_P(member)[0] == '\0') {