From: Xinchen Hui <laruence@gmail.com>
Date: Mon, 24 Feb 2014 09:26:09 +0000 (+0800)
Subject: Fixed invalid write in vsprintf tests
X-Git-Tag: POST_PHPNG_MERGE~412^2~556^2~9
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=479b82c0d4c4c0cf3f3ccb4333ba9f2d8df65edd;p=php

Fixed invalid write in vsprintf tests
---

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 26791c357b..0bb4c6f0a3 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -251,14 +251,14 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
 		 * so that if handler used some class, crash would not happen */
 		if (Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
 			zeh = &EG(user_error_handler);
-			ZVAL_UNDEF(&EG(user_error_handler));
 			zval_ptr_dtor(zeh);
+			ZVAL_UNDEF(&EG(user_error_handler));
 		}
 
 		if (Z_TYPE(EG(user_exception_handler)) != IS_UNDEF) {
 			zeh = &EG(user_exception_handler);
-			ZVAL_UNDEF(&EG(user_exception_handler));
 			zval_ptr_dtor(zeh);
+			ZVAL_UNDEF(&EG(user_exception_handler));
 		}
 
 		zend_stack_destroy(&EG(user_error_handlers_error_reporting));
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 6317c8214c..b8724dea55 100644
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -395,9 +395,7 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 		zval array;
 
 		z_format = &args[format_offset];
-		ZVAL_COPY_VALUE(&array, &args[1 + format_offset]);
-		
-		SEPARATE_ZVAL(&array);
+		ZVAL_DUP(&array, &args[1 + format_offset]);
 		convert_to_array_ex(&array);
 		
 		argc = 1 + zend_hash_num_elements(Z_ARRVAL(array));
@@ -411,6 +409,7 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 			i++;
 		}
 		efree(args);
+		zval_dtor(&array);
 		args = newargs;
 		format_offset = 0;
 	}