From: Dmitry Stogov <dmitry@php.net>
Date: Mon, 6 Jun 2005 10:38:22 +0000 (+0000)
Subject: Fixed bug #32799 (crash: calling the corresponding global var during the destruct)
X-Git-Tag: php-5.0.5RC1~206
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=21d984c1bb9f6ac834f4b43a8af1a579661796f6;p=php

Fixed bug #32799 (crash: calling the corresponding global var during the destruct)
---

diff --git a/NEWS b/NEWS
index ce8eabf1ae..1b4f5dcff3 100644
--- a/NEWS
+++ b/NEWS
@@ -58,6 +58,8 @@ PHP                                                                        NEWS
 - Fixed bug #32809 (Missing T1LIB support on Windows). (Edin)
 - Fixed bug #32802 (General cookie overrides more specific cookie). (Ilia)
 - Fixed bugs #32800, #32830 (ext/odbc: Problems with 64bit systems). (Jani)
+- Fixed bug #32799 (crash: calling the corresponding global var during the
+  destruct). (Dmitry)
 - Fixed bug #32776 (SOAP doesn't support one-way operations). (Dmitry)
 - Fixed bug #32773 (GMP functions break when second parameter is 0). (Stas)
 - Fixed bug #32759 (incorrect determination of default value (COM)). (Wez)
diff --git a/Zend/tests/bug32799.phpt b/Zend/tests/bug32799.phpt
new file mode 100755
index 0000000000..7b09a50274
--- /dev/null
+++ b/Zend/tests/bug32799.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #32799 (crash: calling the corresponding global var during the destruct)
+--FILE--
+<?php
+class test{
+  public $c=1;
+  function __destruct (){
+    $GLOBALS['p']->c++; // no warning
+    print $GLOBALS['p']->c."\n"; // segfault
+  	var_dump($GLOBALS['p']);
+  }
+}
+$p=new test;
+$p=null; //destroy the object by a new assignment (segfault)
+?>
+--EXPECT--
+2
+object(test)#1 (1) {
+  ["c"]=>
+  int(2)
+}
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index 6aa2d80b56..d37b4976e8 100644
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -151,7 +151,9 @@ ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
 				EG(objects_store).object_buckets[handle].destructor_called = 1;
 
 				if (obj->dtor) {
+					zobject->refcount++;
 					obj->dtor(obj->object, handle TSRMLS_CC);
+					zobject->refcount--;
 				}
 			}
 			if (obj->refcount == 1) {