Fix #62432 ReflectionMethod random corrupt memory on high concurrent

This fixes the same issue in multiple extensions. This isn't needed
in later branches as 5.4 introduced object_properties_init()

diff --git a/NEWS b/NEWS
index 79db5c6b7bf31975e2f6b15bde11082b73b0a4be..520aa192f277416d354ac95961ce39b12448cb91 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
   . Fixed CVE-2012-2143. (Solar Designer)
   . Fixed potential overflow in _php_stream_scandir. (Jason Powell,
     Stas)
+  . Fixed bug #62432 (ReflectionMethod random corrupt memory on high
+    concurrent). (Johannes)
 
 - Fileinfo:
   . Fixed magic file regex support. (Felipe)

diff --git a/ext/date/php_date.c b/ext/date/php_date.c
index ab4cc4944293e529cf5c0a17c82dd116e748b977..527894d2236e0b8160ffff21b4163862a8903573 100644 (file)
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
@@ -2035,7 +2035,7 @@ static inline zend_object_value date_object_new_date_ex(zend_class_entry *class_
        }
        
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_date, NULL TSRMLS_CC);
        retval.handlers = &date_object_handlers_date;
@@ -2159,7 +2159,7 @@ static inline zend_object_value date_object_new_timezone_ex(zend_class_entry *cl
        }
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_timezone, NULL TSRMLS_CC);
        retval.handlers = &date_object_handlers_timezone;
@@ -2215,7 +2215,7 @@ static inline zend_object_value date_object_new_interval_ex(zend_class_entry *cl
        }
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_interval, NULL TSRMLS_CC);
        retval.handlers = &date_object_handlers_interval;
@@ -2291,7 +2291,7 @@ static inline zend_object_value date_object_new_period_ex(zend_class_entry *clas
        }
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_period, NULL TSRMLS_CC);
        retval.handlers = &date_object_handlers_period;

diff --git a/ext/fileinfo/fileinfo.c b/ext/fileinfo/fileinfo.c
index 2c0e39a714fc3934796076eed086fed9af142023..36c5e392ebcebba7d27858807495f40f6e5fca08 100644 (file)
--- a/ext/fileinfo/fileinfo.c
+++ b/ext/fileinfo/fileinfo.c
@@ -104,7 +104,7 @@ PHP_FILEINFO_API zend_object_value finfo_objects_new(zend_class_entry *class_typ
        memset(intern, 0, sizeof(struct finfo_object));
 
        zend_object_std_init(&intern->zo, class_type TSRMLS_CC);
-       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,(void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor,(void *) &tmp, sizeof(zval *));
 
        intern->ptr = NULL;
 

diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index 1c3bb8a8b3d3fe61da1c02f00b292cb8af2814a7..6b3ba3bb1bad865961d1a3ad2b09a7f8190f4f3f 100755 (executable)
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -1580,7 +1580,7 @@ zend_object_value pdo_dbh_new(zend_class_entry *ce TSRMLS_DC)
        dbh->refcount = 1;
        ALLOC_HASHTABLE(dbh->properties);
        zend_hash_init(dbh->properties, 0, NULL, ZVAL_PTR_DTOR, 0);
-       zend_hash_copy(dbh->properties, &ce->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(dbh->properties, &ce->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        dbh->def_stmt_ce = pdo_dbstmt_ce;
        
        retval.handle = zend_objects_store_put(dbh, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t)pdo_dbh_free_storage, NULL TSRMLS_CC);

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index f2828499f7b2c5376a2b94fa68df49aac2c8246e..0cf0cf852a6c64069fb0620dbbe93c3406fe972d 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2466,7 +2466,7 @@ zend_object_value pdo_dbstmt_new(zend_class_entry *ce TSRMLS_DC)
        stmt->refcount = 1;
        ALLOC_HASHTABLE(stmt->properties);
        zend_hash_init(stmt->properties, 0, NULL, ZVAL_PTR_DTOR, 0);
-       zend_hash_copy(stmt->properties, &ce->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(stmt->properties, &ce->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(stmt, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t)pdo_dbstmt_free_storage, (zend_objects_store_clone_t)dbstmt_clone_obj TSRMLS_CC);
        retval.handlers = &pdo_dbstmt_object_handlers;

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 180ce8f91aa817ce709fc88d83d842c7104e3f0d..e98652ba2326bd9391b730afdaf96c017d9fab48 100644 (file)
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -314,7 +314,7 @@ static zend_object_value reflection_objects_new(zend_class_entry *class_type TSR
        intern->zo.ce = class_type;
 
        zend_object_std_init(&intern->zo, class_type TSRMLS_CC);
-       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        retval.handle = zend_objects_store_put(intern, NULL, reflection_free_objects_storage, NULL TSRMLS_CC);
        retval.handlers = &reflection_object_handlers;
        return retval;

diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index 87391ab76dd0b740685f58ac8f8d588e0ab106f9..120f78071b509d6e077da24c3bdc397a5cfcef82 100644 (file)
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -1265,7 +1265,7 @@ PHP_METHOD(SoapServer, SoapServer)
 
                        ALLOC_HASHTABLE(service->class_map);
                        zend_hash_init(service->class_map, zend_hash_num_elements((*tmp)->value.ht), NULL, ZVAL_PTR_DTOR, 0);
-                       zend_hash_copy(service->class_map, (*tmp)->value.ht, (copy_ctor_func_t) zval_add_ref, (void *) &ztmp, sizeof(zval *));
+                       zend_hash_copy(service->class_map, (*tmp)->value.ht, (copy_ctor_func_t) zval_property_ctor, (void *) &ztmp, sizeof(zval *));
                }
 
                if (zend_hash_find(ht, "typemap", sizeof("typemap"), (void**)&tmp) == SUCCESS &&

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 5bbab907e46bd5fe76251187feb78242685fcb79..80ca5be612874f105d073421499b2420c8b3aa8e 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -174,7 +174,7 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
        ALLOC_INIT_ZVAL(intern->retval);
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        intern->ar_flags = 0;
        intern->serialize_data   = NULL;

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index aaa256de7b27c2ac9462fa702c3711e3e54f5f17..4f8edb5211a8d9011209855698f6cb53d5fa059e 100755 (executable)
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -158,7 +158,7 @@ static zend_object_value spl_filesystem_object_new_ex(zend_class_entry *class_ty
        if (obj) *obj = intern;
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t) zend_objects_destroy_object, (zend_objects_free_object_storage_t) spl_filesystem_object_free_storage, NULL TSRMLS_CC);
        retval.handlers = &spl_filesystem_object_handlers;

diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c
index 84afdd6849006782b4724af8d6f84c2a9532cfac..0774857cc38be61e545333a6f6e878bf6e8e7a08 100644 (file)
--- a/ext/spl/spl_dllist.c
+++ b/ext/spl/spl_dllist.c
@@ -376,7 +376,7 @@ static zend_object_value spl_dllist_object_new_ex(zend_class_entry *class_type,
        ALLOC_INIT_ZVAL(intern->retval);
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        intern->flags = 0;
        intern->traverse_position = 0;

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 4cd78f3774bc1b84be12fb9d6617f2e7f47a4d31..ee8f51eb33f2a98efa61955d205f336321fea8e6 100644 (file)
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -215,7 +215,7 @@ static zend_object_value spl_fixedarray_object_new_ex(zend_class_entry *class_ty
        ALLOC_INIT_ZVAL(intern->retval);
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        intern->current = 0;
        intern->flags = 0;

diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c
index a0055f410df44e7ccd7e3d75e9153f32e53bff6c..a663422a2758c94c543ee5849aa42a350127610c 100644 (file)
--- a/ext/spl/spl_heap.c
+++ b/ext/spl/spl_heap.c
@@ -394,7 +394,7 @@ static zend_object_value spl_heap_object_new_ex(zend_class_entry *class_type, sp
        ALLOC_INIT_ZVAL(intern->retval);
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        intern->flags      = 0;
        intern->fptr_cmp   = NULL;

diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index ddcdedbd69de329df56021f789fbfbb01cf5fbbe..eecd483ba77d099d6371c3ef41027aa985d05818 100755 (executable)
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -921,7 +921,7 @@ static zend_object_value spl_RecursiveIteratorIterator_new_ex(zend_class_entry *
        }
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)spl_RecursiveIteratorIterator_dtor, (zend_objects_free_object_storage_t) spl_RecursiveIteratorIterator_free_storage, NULL TSRMLS_CC);
        retval.handlers = &spl_handlers_rec_it_it;

diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index a1e497ec5e7379f397768df652972bc453057467..85bbeec73192b5bf0d7e7130967f7ce47dc85f44 100755 (executable)
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -206,7 +206,7 @@ static zend_object_value spl_object_storage_new_ex(zend_class_entry *class_type,
        *obj = intern;
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        zend_hash_init(&intern->storage, 0, NULL, (void (*)(void *))spl_object_storage_dtor, 0);
 

diff --git a/ext/sqlite/sqlite.c b/ext/sqlite/sqlite.c
index 15517db909cac831c49037c2b18c3f069db3f379..a7070a9b060be71e5fc8cc5a862819a10ba925fa 100644 (file)
--- a/ext/sqlite/sqlite.c
+++ b/ext/sqlite/sqlite.c
@@ -1166,7 +1166,7 @@ static void sqlite_object_new(zend_class_entry *class_type, zend_object_handlers
        memset(intern, 0, sizeof(sqlite_object));
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        retval->handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) sqlite_object_free_storage, NULL TSRMLS_CC);
        retval->handlers = handlers;

diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c
index e793206624cd9a1f5acedfab5392a7487d96177e..d3314d3f864f5dc887adfc4939d715e5d14d2727 100644 (file)
--- a/ext/sqlite3/sqlite3.c
+++ b/ext/sqlite3/sqlite3.c
@@ -2134,7 +2134,7 @@ static zend_object_value php_sqlite3_object_new(zend_class_entry *class_type TSR
        zend_llist_init(&(intern->free_list),   sizeof(php_sqlite3_free_list *), (llist_dtor_func_t)php_sqlite3_free_list_dtor, 0);
 
        zend_object_std_init(&intern->zo, class_type TSRMLS_CC);
-       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,(void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor,(void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(intern, NULL, (zend_objects_free_object_storage_t) php_sqlite3_object_free_storage, NULL TSRMLS_CC);
        retval.handlers = (zend_object_handlers *) &sqlite3_object_handlers;
@@ -2156,7 +2156,7 @@ static zend_object_value php_sqlite3_stmt_object_new(zend_class_entry *class_typ
        intern->db_obj_zval = NULL;
 
        zend_object_std_init(&intern->zo, class_type TSRMLS_CC);
-       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,(void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor,(void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(intern, NULL, (zend_objects_free_object_storage_t) php_sqlite3_stmt_object_free_storage, NULL TSRMLS_CC);
        retval.handlers = (zend_object_handlers *) &sqlite3_stmt_object_handlers;
@@ -2180,7 +2180,7 @@ static zend_object_value php_sqlite3_result_object_new(zend_class_entry *class_t
        intern->stmt_obj_zval = NULL;
 
        zend_object_std_init(&intern->zo, class_type TSRMLS_CC);
-       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,(void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor,(void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(intern, NULL, (zend_objects_free_object_storage_t) php_sqlite3_result_object_free_storage, NULL TSRMLS_CC);
        retval.handlers = (zend_object_handlers *) &sqlite3_result_object_handlers;

diff --git a/ext/tidy/tidy.c b/ext/tidy/tidy.c
index 619d5a3a6acea6ebbccb48de2c19d574bb74d92c..529929342fdccb08456e61edcb68c0fcaa580d5a 100644 (file)
--- a/ext/tidy/tidy.c
+++ b/ext/tidy/tidy.c
@@ -687,7 +687,7 @@ static void tidy_object_new(zend_class_entry *class_type, zend_object_handlers *
        memset(intern, 0, sizeof(PHPTidyObj));
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
        
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
 
        switch(objtype) {
                case is_node:

diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
index 4ffdb179ff53545a90876bd7ca63b557d44c999a..7a4cd0e71842f1c7d0377a0255205b8156ae5de1 100644 (file)
--- a/ext/xmlreader/php_xmlreader.c
+++ b/ext/xmlreader/php_xmlreader.c
@@ -401,7 +401,7 @@ zend_object_value xmlreader_objects_new(zend_class_entry *class_type TSRMLS_DC)
        intern->prop_handler = &xmlreader_prop_handlers;
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) xmlreader_objects_free_storage, xmlreader_objects_clone TSRMLS_CC);
        intern->handle = retval.handle;
        retval.handlers = &xmlreader_object_handlers;

diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index 588ca4bf3a1e9acd191b10d30ee556e4f89215f1..c1152eb11345446afd2fff11ce40f4d0e20a0239 100644 (file)
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -151,7 +151,7 @@ static zend_object_value xmlwriter_object_new(zend_class_entry *class_type TSRML
        intern->xmlwriter_ptr = NULL;
        
        zend_object_std_init(&intern->zo, class_type TSRMLS_CC);
-       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,
+       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor,
                                        (void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(intern,

diff --git a/ext/xsl/php_xsl.c b/ext/xsl/php_xsl.c
index 7262e7804a0d68b340cc4e1d4df3d26cf9ad8bf7..6f7237d57dad8e45ef0f0ccb0ce09d47db94bd11 100644 (file)
--- a/ext/xsl/php_xsl.c
+++ b/ext/xsl/php_xsl.c
@@ -129,7 +129,7 @@ zend_object_value xsl_objects_new(zend_class_entry *class_type TSRMLS_DC)
        intern->profiling = NULL;
 
        zend_object_std_init(&intern->std, class_type TSRMLS_CC);
-       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+       zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, (void *) &tmp, sizeof(zval *));
        ALLOC_HASHTABLE(intern->parameter);
        zend_hash_init(intern->parameter, 0, NULL, ZVAL_PTR_DTOR, 0);
        ALLOC_HASHTABLE(intern->registered_phpfunctions);

diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c
index e6a30a006614ac14f85611ae4d4f231136df898a..75f98b591f6e5b656786b38e42f0ca759a8eca80 100644 (file)
--- a/ext/zip/php_zip.c
+++ b/ext/zip/php_zip.c
@@ -1104,7 +1104,7 @@ static zend_object_value php_zip_object_new(zend_class_entry *class_type TSRMLS_
        intern->zo.ce = class_type;
 #endif
 
-       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,
+       zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_property_ctor, 
                                        (void *) &tmp, sizeof(zval *));
 
        retval.handle = zend_objects_store_put(intern,