Fixed bug #60558 (Invalid read and writes)

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index d524c23faa337f8edf300d34daf3a7f0aef4da13..152a86243a6e6429882411aa3a0ee5a7fbe69036 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -85,6 +85,7 @@ ZEND_API void rebuild_object_properties(zend_object *zobj) /* {{{ */
                                            prop_info->offset >= 0 &&
                                                zobj->properties_table[prop_info->offset]) {
                                                if (UNEXPECTED(flags[prop_info->offset])) {
+                                                       Z_ADDREF_P(*(zval **)zobj->properties_table[prop_info->offset]);
                                                        zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]);
                                                } else {
                                                        zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)&zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]);