Fixed bug #31158 (array_splice on $GLOBALS crashes)

diff --git a/NEWS b/NEWS
index 4f4cc9a09659d14883343218377785dcf185e657..5f9b49f9d6b6fd22ca387fb91c7f5f48d5260569 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? 2005, Version 4.4.1
+- Fixed bug #31158 (array_splice on $GLOBALS crashes). (Dmitry)
+
 11 Jul 2005, Version 4.4.0
 - Added man pages for "phpize" and "php-config" scripts. (Jakub Vrana)
 - Added support for .cc files in extensions. (Brian)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 0f87fede69bbc97637f5ed12b187f6a3f41d943b..2ceef88b7f92499f9cbf6eaada9c294c1eb781e3 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1831,8 +1831,8 @@ PHP_FUNCTION(array_unshift)
           hashtable and replace it with new one */
        new_hash = php_splice(Z_ARRVAL_P(stack), 0, 0, &args[1], argc-1, NULL);
        zend_hash_destroy(Z_ARRVAL_P(stack));
-       efree(Z_ARRVAL_P(stack));
-       Z_ARRVAL_P(stack) = new_hash;
+       *Z_ARRVAL_P(stack) = *new_hash;
+       FREE_HASHTABLE(new_hash);
 
        /* Clean up and return the number of elements in the stack */
        efree(args);
@@ -1909,8 +1909,8 @@ PHP_FUNCTION(array_splice)
        
        /* Replace input array's hashtable with the new one */
        zend_hash_destroy(Z_ARRVAL_P(array));
-       efree(Z_ARRVAL_P(array));
-       Z_ARRVAL_P(array) = new_hash;
+       *Z_ARRVAL_P(array) = *new_hash;
+       FREE_HASHTABLE(new_hash);
        
        /* Clean up */
        if (argc == 4)
@@ -2397,8 +2397,8 @@ PHP_FUNCTION(array_pad)
        
        /* Copy the result hash into return value */
        zend_hash_destroy(Z_ARRVAL_P(return_value));
-       efree(Z_ARRVAL_P(return_value));
-       Z_ARRVAL_P(return_value) = new_hash;
+       *Z_ARRVAL_P(return_value) = *new_hash;
+       FREE_HASHTABLE(new_hash);
        
        /* Clean up */
        efree(pads);