Fixed bug #63180 (Corruption of hash tables)

diff --git a/NEWS b/NEWS
index c846798da9eab9c1a6217380a1e685db126b8056..d95f5f4293a9e397f88b8d6abf9c31005b90ebeb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
     (Chris Jones)
 
 - PCRE:
+  . Fixed bug #63180 (Corruption of hash tables). (Dmitry)
   . Fixed bug #63055 (Segfault in zend_gc with SF2 testsuite).
     (Dmitry, Laruence)
   . Fixed bug #63284 (Upgrade PCRE to 8.31). (Anatoliy)

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index f61364cde96192d78dacb4e5aee86d407b7a980a..2f892c8e9402adfa1ca0f3339165bc1d36584df9 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -248,6 +248,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
 #endif
        pcre_cache_entry        *pce;
        pcre_cache_entry         new_entry;
+       char                *tmp = NULL;
 
        /* Try to lookup the cached regex entry, and if successful, just pass
           back the compiled pattern, otherwise go on and compile it. */
@@ -438,9 +439,26 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
        new_entry.locale = pestrdup(locale, 1);
        new_entry.tables = tables;
 #endif
+
+       /*
+        * Interned strings are not duplicated when stored in HashTable,
+        * but all the interned strings created during HTTP request are removed
+        * at end of request. However PCRE_G(pcre_cache) must be consistent
+        * on the next request as well. So we disable usage of interned strings
+        * as hash keys especually for this table.
+        * See bug #63180 
+        */
+       if (IS_INTERNED(regex)) {
+               regex = tmp = estrndup(regex, regex_len);
+       }
+
        zend_hash_update(&PCRE_G(pcre_cache), regex, regex_len+1, (void *)&new_entry,
                                                sizeof(pcre_cache_entry), (void**)&pce);
 
+       if (tmp) {
+               efree(tmp);
+       }
+
        return pce;
 }
 /* }}} */