Fixed invalid write in vsprintf tests

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 26791c357bfaa9fbd0d2c16371ced2ff516dca01..0bb4c6f0a302a8e03182e3c68cec2f1a8d252394 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -251,14 +251,14 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
                 * so that if handler used some class, crash would not happen */
                if (Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
                        zeh = &EG(user_error_handler);
-                       ZVAL_UNDEF(&EG(user_error_handler));
                        zval_ptr_dtor(zeh);
+                       ZVAL_UNDEF(&EG(user_error_handler));
                }
 
                if (Z_TYPE(EG(user_exception_handler)) != IS_UNDEF) {
                        zeh = &EG(user_exception_handler);
-                       ZVAL_UNDEF(&EG(user_exception_handler));
                        zval_ptr_dtor(zeh);
+                       ZVAL_UNDEF(&EG(user_exception_handler));
                }
 
                zend_stack_destroy(&EG(user_error_handlers_error_reporting));

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 6317c8214cdb398784566652d45ef6da6dd0c866..b8724dea55dc7071e99bda718289f9f6d6665a81 100644 (file)
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -395,9 +395,7 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
                zval array;
 
                z_format = &args[format_offset];
-               ZVAL_COPY_VALUE(&array, &args[1 + format_offset]);
-               
-               SEPARATE_ZVAL(&array);
+               ZVAL_DUP(&array, &args[1 + format_offset]);
                convert_to_array_ex(&array);
                
                argc = 1 + zend_hash_num_elements(Z_ARRVAL(array));
@@ -411,6 +409,7 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
                        i++;
                }
                efree(args);
+               zval_dtor(&array);
                args = newargs;
                format_offset = 0;
        }