Fixed memory corruption

diff --git a/ext/ctype/ctype.c b/ext/ctype/ctype.c
index 53420058b6dbdc74feb6e693bbd9d947659dd433..d863783ff3a76e6ad5e616497ac85d42cae8a763 100644 (file)
--- a/ext/ctype/ctype.c
+++ b/ext/ctype/ctype.c
@@ -92,7 +92,7 @@ PHP_MINFO_FUNCTION(ctype)
 /* {{{ ctype
  */
 #define CTYPE(iswhat) \
-       zval *c; \
+       zval *c, tmp; \
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z", &c) == FAILURE) \
                return; \
        switch (Z_TYPE_P(c)) { \
@@ -102,23 +102,33 @@ PHP_MINFO_FUNCTION(ctype)
                } else if (Z_LVAL_P(c) >= -128 && Z_LVAL_P(c) < 0) { \
                        RETURN_BOOL(iswhat(Z_LVAL_P(c) + 256)); \
                } \
-               SEPARATE_ZVAL(&c);      \
-               convert_to_string(c);   \
+               tmp = *c; \
+               zval_copy_ctor(&tmp); \
+               convert_to_string(&tmp); \
+               c = &tmp; \
        case IS_STRING: \
        case IS_BINARY: \
 string:\
                { \
                        char *p = Z_STRVAL_P(c), *e = Z_STRVAL_P(c) + Z_STRLEN_P(c); \
                        if (e == p) {   \
+                               if (c == &tmp) zval_dtor(&tmp); \
                                RETURN_FALSE;   \
                        }       \
                        while (p < e) { \
-                               if(!iswhat((int)*(unsigned char *)(p++))) RETURN_FALSE; \
+                               if(!iswhat((int)*(unsigned char *)(p++))) { \
+                                       if (c == &tmp) zval_dtor(&tmp); \
+                                       RETURN_FALSE; \
+                               } \
                        } \
+                       if (c == &tmp) zval_dtor(&tmp); \
                        RETURN_TRUE; \
                } \
        case IS_UNICODE: \
-               convert_to_string(c); \
+               tmp = *c; \
+               zval_copy_ctor(&tmp); \
+               convert_to_string(&tmp); \
+               c = &tmp; \
                goto string; \
        default: \
                break; \