]> granicus.if.org Git - php/commitdiff
fix segfault when running run-tests.php, and general potential for corruption
authorGreg Beaver <cellog@php.net>
Fri, 31 Jul 2009 23:44:52 +0000 (23:44 +0000)
committerGreg Beaver <cellog@php.net>
Fri, 31 Jul 2009 23:44:52 +0000 (23:44 +0000)
by calling php_stream_path_encode for unicode strings, php_stream_path_param_encode decrements
the refcount, but never restores it, which can cause freeing of zvals before they are done being used.

main/php_streams.h

index a13c3236203f70f9b9c8e3945fcfa0c5064a8d88..472885a5520678124170c6632cbd93f05915d81c 100755 (executable)
@@ -422,6 +422,7 @@ static inline int _php_stream_path_param_encode(zval **ppzval, char **ppath, int
                if (FAILURE == php_stream_path_encode(NULL, &path, &path_len, Z_USTRVAL_PP(ppzval), Z_USTRLEN_PP(ppzval), options, context)) {
                        return FAILURE;
                }
+               Z_ADDREF_PP(ppzval); /* the conversion removes a refcount */
                MAKE_STD_ZVAL(zpath);
                ZVAL_STRINGL(zpath, path, path_len, 0);
                Z_UNSET_ISREF_P(zpath);