From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 7 Apr 2011 13:35:27 +0000 (+0000)
Subject: Fixed bug #54372 (Crash accessing global object itself returned from its __get()... 
X-Git-Tag: php-5.4.0alpha1~191^2~79
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2e25ec9eb7625d48af19c7ca061b90f9e6337ae8;p=php

Fixed bug #54372 (Crash accessing global object itself returned from its __get() handle)
---

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index fd835a1817..b640d49a97 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -446,7 +446,11 @@ zval *zend_std_read_property(zval *object, zval *member, int type, const zend_li
 			} else {
 				retval = &EG(uninitialized_zval_ptr);
 			}
-			zval_ptr_dtor(&object);
+			if (EXPECTED(*retval != object)) {
+				zval_ptr_dtor(&object);
+			} else {
+				Z_DELREF_P(object);
+			}
 		} else {
 			if (zobj->ce->__get && guard && guard->in_get == 1) {
 				if (Z_STRVAL_P(member)[0] == '\0') {