fix possible crash - we should never keep the zval** as they might point

somewhere into the Engine. (there's still a new bug in strtok - hunting;-)

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index e136a4298c5e89f7df9acaff1eb69795d48de637..f8c8cba25bd86d663e9e7363f634bfa3eca277b8 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -894,7 +894,7 @@ PHP_RINIT_FUNCTION(basic)
 PHP_RSHUTDOWN_FUNCTION(basic)
 {
        if (BG(strtok_zval))
-               zval_ptr_dtor(BG(strtok_zval));
+               zval_ptr_dtor(&BG(strtok_zval));
        BG(strtok_string) = NULL;
        BG(strtok_zval) = NULL;
 #ifdef HAVE_PUTENV

diff --git a/ext/standard/basic_functions.h b/ext/standard/basic_functions.h
index 900a1b13f5b9757a9c7dabdc7c2781d6ea16d8f7..e22a604eeb3147a6531d6cad9ed3822362c55b15 100644 (file)
--- a/ext/standard/basic_functions.h
+++ b/ext/standard/basic_functions.h
@@ -141,7 +141,7 @@ typedef signed int php_int32;
 typedef struct {
        HashTable *user_shutdown_function_names;
        HashTable putenv_ht;
-       zval **strtok_zval;
+       zval *strtok_zval;
        char *strtok_string;
        char *locale_string;
        char *strtok_last;

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 8cfc6095493dd2881cc5f515186d446d855676c8..0ca7ac5f91ae1102e48079258cf93d2a78b251fc 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -867,8 +867,8 @@ PHP_FUNCTION(strtok)
 
                zval_add_ref(str);
                if (BG(strtok_zval))
-                       zval_ptr_dtor(BG(strtok_zval));
-               BG(strtok_zval) = str;
+                       zval_ptr_dtor(&BG(strtok_zval));
+               BG(strtok_zval) = *str;
                
                BG(strtok_last) = BG(strtok_string) = Z_STRVAL_PP(str);
                BG(strtok_len) = Z_STRLEN_PP(str);