MFH: Fixed bug #30572 (crash when comparing SimpleXML attribute to a boolean).

diff --git a/NEWS b/NEWS
index 54ec4f7730ed88eae8ba699e47fd4820b9e3b63c..5031919733630713aaa058e0853e10dc5afedbff 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, PHP 5.0.3
 - Fixed potential problems with unserializing invalid serialize data. (Marcus)
+- Fixed bug #30572 (crash when comparing SimpleXML attribute to a boolean).
+  (Ilia)
 - Fixed bug #30475 (curl_getinfo() may crash in some situations). (Ilia)
 - Fixed bug #30442 (segfault when parsing ?getvariable[][ ). (Tony)
 - Fixed bug #30387 (stream_socket_client async connect was broken).

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 76c21878ec5d89e089c8e24eba4157bab3ed08fa..3890bc13e431899407596472f5336f6c4a3ef3d8 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -1330,7 +1330,11 @@ ZEND_API int compare_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
        
        if (op1->type == IS_BOOL || op2->type == IS_BOOL
                || op1->type == IS_NULL || op2->type == IS_NULL) {
-               zendi_convert_to_boolean(op1, op1_copy, result);
+               if (free_op1) {
+                       convert_to_boolean(op1);
+               } else {
+                       zendi_convert_to_boolean(op1, op1_copy, result);
+               }
                zendi_convert_to_boolean(op2, op2_copy, result);
                result->type = IS_LONG;
                result->value.lval = ZEND_NORMALIZE_BOOL(op1->value.lval-op2->value.lval);