Fixed bug #64827 Segfault in zval_mark_grey (zend_gc.c)

I can not get a reproduce script since the context is very strict.

Of course I will try to make one, but for now, I just commit this first.

diff --git a/NEWS b/NEWS
index ee3d858e69a292c993ef44b1d3a49a4694d2a4e9..18eedd3f3e69074c9831db945e3eb7746927d8d3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,7 @@ PHP                                                                        NEWS
     (David Soria Parra, Laruence)
 
 - OPcache
+  . Fixed bug #64827 (Segfault in zval_mark_grey (zend_gc.c)). (Laruence)
   . OPcache must be compatible with LiteSpeed SAPI (Dmitry)
 
 - CLI server:

diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index 4d983976bbdf3c8dc45609b8ac969a1abbc2fc25..efd902f431816041c2903508658ce2c258e78fd9 100644 (file)
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -2163,7 +2163,10 @@ static void accel_fast_zval_ptr_dtor(zval **zval_ptr)
                        case IS_CONSTANT_ARRAY: {
                                        TSRMLS_FETCH();
 
+                                       GC_REMOVE_ZVAL_FROM_BUFFER(zvalue);
                                        if (zvalue->value.ht && (zvalue->value.ht != &EG(symbol_table))) {
+                                               /* break possible cycles */
+                                               Z_TYPE_P(zvalue) = IS_NULL;
                                                zvalue->value.ht->pDestructor = (dtor_func_t)accel_fast_zval_ptr_dtor;
                                                accel_fast_hash_destroy(zvalue->value.ht);
                                        }
@@ -2173,6 +2176,7 @@ static void accel_fast_zval_ptr_dtor(zval **zval_ptr)
                                {
                                        TSRMLS_FETCH();
 
+                                       GC_REMOVE_ZVAL_FROM_BUFFER(zvalue);
                                        Z_OBJ_HT_P(zvalue)->del_ref(zvalue TSRMLS_CC);
                                }
                                break;