Fix possible data corruption with __set()

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index eaa575db4d8273acc1a38718cc6c1f442908b567..d256613a79a5220209766206e7760c4d77ab0bc4 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -434,7 +434,6 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode
                }
                Z_OBJ_HT_P(object)->write_dimension(object, property_name, value TSRMLS_CC);
        }
-       zval_ptr_dtor(&value);
        
        FREE_OP(Ts, op2, EG(free_op2));
        if (result) {
@@ -442,6 +441,7 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode
                T(result->u.var).var.ptr_ptr = NULL; /* see if we can remove this */
                SELECTIVE_PZVAL_LOCK(value, result);
        }
+       zval_ptr_dtor(&value);
 }