Fixed rarely possible use-after-free

diff --git a/ext/opcache/Optimizer/zend_optimizer.c b/ext/opcache/Optimizer/zend_optimizer.c
index 08ac084713cdd1505623074542b9e57020981275..c5f62b31724efe9432cf917896fa5a3a6b114955 100644 (file)
--- a/ext/opcache/Optimizer/zend_optimizer.c
+++ b/ext/opcache/Optimizer/zend_optimizer.c
@@ -1027,6 +1027,19 @@ int zend_optimize_script(zend_script *script, zend_long optimization_level, zend
                        ZEND_SET_FUNC_INFO(call_graph.op_arrays[i], NULL);
                }
 
+               ZEND_HASH_FOREACH_PTR(&script->class_table, ce) {
+                       ZEND_HASH_FOREACH_STR_KEY_PTR(&ce->function_table, name, op_array) {
+                               if (op_array->scope != ce) {
+                                       zend_op_array *orig_op_array;
+                                       if ((orig_op_array = zend_hash_find_ptr(&op_array->scope->function_table, name)) != NULL) {
+                                               HashTable *ht = op_array->static_variables;
+                                               *op_array = *orig_op_array;
+                                               op_array->static_variables = ht;
+                                       }
+                               }
+                       } ZEND_HASH_FOREACH_END();
+               } ZEND_HASH_FOREACH_END();
+
                zend_arena_release(&ctx.arena, checkpoint);
        } else
 #endif