Fixed bug #63055 (Segfault in zend_gc with SF2 testsuite)

diff --git a/NEWS b/NEWS
index 86f862964224400bef10f560a3479297713c002c..009f082bd073fd471f7abad166469faff2ac5493 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,9 +2,13 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.3.19
 
-- mysql:
+- MySQL:
   . Fixed compilation failure on mixed 32/64 bit systems. (Andrey)
 
+- PCRE:
+  . Fixed bug #63055 (Segfault in zend_gc with SF2 testsuite).
+    (Dmitry, Laruence)
+
 - PDO:
   . Fixed bug #63235 (buffer overflow in use of SQLGetDiagRec).
     (Martin Osvald, Remi)

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index b1b9e66e9afc632244eb398046100d2347115c4c..1af815125150dbd5572d6bf62f862db99fd91ba4 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -547,8 +547,9 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 
        /* Overwrite the passed-in value for subpatterns with an empty array. */
        if (subpats != NULL) {
-               zval_dtor(subpats);
+               zval garbage = *subpats;
                array_init(subpats);
+               zval_dtor(&garbage);
        }
 
        subpats_order = global ? PREG_PATTERN_ORDER : 0;

diff --git a/ext/pcre/tests/bug63055.phpt b/ext/pcre/tests/bug63055.phpt
new file mode 100644 (file)
index 0000000..16c50b5
--- /dev/null
+++ b/ext/pcre/tests/bug63055.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #63055 (Segfault in zend_gc with SF2 testsuite)
+--FILE--
+<?php
+/* the default gc root size is 10,000 */
+for ($i=0; $i<9998; $i++) {
+    $array = array();
+    $array[0] = &$array;
+    unset($array);
+}
+
+$matches = array("foo" => "bar"); /* this bucket will trigger the segfault */
+$dummy   = array("dummy");        /* used to trigger gc_collect_cycles */
+$dummy[1] = &$dummy;
+
+$matches[1] = &$matches;
+$matches[2] = $dummy;
+
+preg_match_all("/(\d)+/", "foo123456bar", $matches);
+echo "okey";
+?>
+--EXPECTF--
+okey