Fixed bug #54372 (Crash accessing global object itself returned from its __get()...

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index fd835a18171af6b2b1b15897d79d6839d339b04f..b640d49a9750bb2148adad02da06e7f0f124a11f 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -446,7 +446,11 @@ zval *zend_std_read_property(zval *object, zval *member, int type, const zend_li
                        } else {
                                retval = &EG(uninitialized_zval_ptr);
                        }
-                       zval_ptr_dtor(&object);
+                       if (EXPECTED(*retval != object)) {
+                               zval_ptr_dtor(&object);
+                       } else {
+                               Z_DELREF_P(object);
+                       }
                } else {
                        if (zobj->ce->__get && guard && guard->in_get == 1) {
                                if (Z_STRVAL_P(member)[0] == '\0') {