Fixed bug #34617 (zend_deactivate: objects_store used after zend_objects_store_destro...

diff --git a/Zend/tests/bug34617.phpt b/Zend/tests/bug34617.phpt
new file mode 100755 (executable)
index 0000000..23c43c4
--- /dev/null
+++ b/Zend/tests/bug34617.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #34617 (zend_deactivate: objects_store used after zend_objects_store_destroy is called) 
+--SKIPIF--
+<?php if (!extension_loaded("xml")) print "skip"; ?>
+--FILE--
+<?php
+class Thing {}
+function boom()
+{
+    $reader = xml_parser_create();
+    xml_set_object($reader, new Thing());
+    die("ok\n");
+    xml_parser_free($reader);
+}
+boom();
+?>
+--EXPECT--
+ok
\ No newline at end of file

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index ab62dcfe48821e6905b1f70a37673b228b349ed0..74caaba5fa3d96df1b1e9c63723848717aa75c09 100644 (file)
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -38,6 +38,7 @@ ZEND_API void zend_objects_store_init(zend_objects_store *objects, zend_uint ini
 ZEND_API void zend_objects_store_destroy(zend_objects_store *objects)
 {
        efree(objects->object_buckets);
+       objects->object_buckets = NULL;
 }
 
 ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TSRMLS_DC)
@@ -138,8 +139,15 @@ ZEND_API void zend_objects_store_add_ref(zval *object TSRMLS_DC)
 
 ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
 {
-       zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
-       struct _store_object *obj = &EG(objects_store).object_buckets[handle].bucket.obj;
+       zend_object_handle handle;
+       struct _store_object *obj;
+       
+       if (!EG(objects_store).object_buckets) {
+               return;
+       }
+
+       handle = Z_OBJ_HANDLE_P(zobject);
+       obj = &EG(objects_store).object_buckets[handle].bucket.obj;
        
        /*      Make sure we hold a reference count during the destructor call
                otherwise, when the destructor ends the storage might be freed