Fixed bug #60558 (Invalid read and writes)

diff --git a/NEWS b/NEWS
index 8ae70e81ebd4b9193f7a45872ad803d4406da365..79c2f2f2acd96138111cea34b7d8c6352da97850 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP                                                                        NEWS
   . Fixed bug #60536 (Traits Segfault). (Laruence)
   . Fixed bug #60362 (non-existent sub-sub keys should not have values).
     (Laruence, alan_k, Stas)
+  . Fixed bug #60558 (Invalid read and writes). (Laruence)
 
 - CLI SAPI:
   . Fixed bug #60477 (Segfault after two multipart/form-data POST requests,

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index d524c23faa337f8edf300d34daf3a7f0aef4da13..152a86243a6e6429882411aa3a0ee5a7fbe69036 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -85,6 +85,7 @@ ZEND_API void rebuild_object_properties(zend_object *zobj) /* {{{ */
                                            prop_info->offset >= 0 &&
                                                zobj->properties_table[prop_info->offset]) {
                                                if (UNEXPECTED(flags[prop_info->offset])) {
+                                                       Z_ADDREF_P(*(zval **)zobj->properties_table[prop_info->offset]);
                                                        zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]);
                                                } else {
                                                        zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)&zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]);