Fixed bug #76713 (Segmentation fault caused by property corruption)

diff --git a/NEWS b/NEWS
index 5ad7f9ad59b77591df9d793738ccf5eae41ece8c..c1c62716f8da9f3cc751cf3ee6522941e7204596 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,10 @@ PHP                                                                        NEWS
   . Fixed bug #76595 (phpdbg man page contains outdated information).
     (Kevin Abel)
 
+- Standard:
+  . Fixed bug #76713 (Segmentation fault caused by property corruption).
+    (Laruence)
+
 - zlib:
   . Fixed bug #65988 (Zlib version check fails when an include/zlib/ style dir
     is passed to the --with-zlib configure option). (Jay Bonci)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index ed917d71d064514534f8fca09ec0d4ea0b54ecc7..187b7182a4ccdda7e41d9725f722aa44d00fa388 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4113,6 +4113,9 @@ static inline zval *array_column_fetch_prop(zval *data, zval *name, zval *rv) /*
                        prop = Z_OBJ_HANDLER_P(data, read_property)(data, name, BP_VAR_R, NULL, rv);
                        if (prop) {
                                ZVAL_DEREF(prop);
+                               if (prop != rv) {
+                                       Z_TRY_ADDREF_P(prop);
+                               }
                        }
                }
        } else if (Z_TYPE_P(data) == IS_ARRAY) {

diff --git a/ext/standard/tests/array/bug76713.phpt b/ext/standard/tests/array/bug76713.phpt
new file mode 100644 (file)
index 0000000..0c993f5
--- /dev/null
+++ b/ext/standard/tests/array/bug76713.phpt
@@ -0,0 +1,39 @@
+--TEST--
+Bug #76713 (Segmentation fault caused by property corruption)
+--FILE--
+<?php
+
+function test($obj) {
+       return array_column(array($obj), "prop");
+}
+
+$obj = new Stdclass();
+
+$obj->prop = str_pad("a", 10, 'a');
+
+test($obj);
+test($obj);
+test($obj);
+
+var_dump($obj->prop);
+
+class C {
+       public $name;
+       public function __get($name) {
+               return $this->name;
+       }
+}
+
+$obj = new C;
+
+$obj->name = str_pad("b", 10, 'b');
+
+test($obj);
+test($obj);
+test($obj);
+
+var_dump($obj->prop);
+?>
+--EXPECT--
+string(10) "aaaaaaaaaa"
+string(10) "bbbbbbbbbb"