From: Dmitry Stogov <dmitry@zend.com>
Date: Thu, 10 Jul 2014 17:45:09 +0000 (+0400)
Subject: Fixed usage after free()
X-Git-Tag: POST_PHPNG_MERGE~65
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4e291fab81eb8c7517d673705ae8a46bf178724b;p=php

Fixed usage after free()
---

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 4e7b479bda..76c732732e 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -627,12 +627,13 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC) /* {{{ */
 			TSRMLS_FETCH();
 
 			convert_object_to_type(op, &dst, IS_STRING, convert_to_string);
-			zval_dtor(op);
 
 			if (Z_TYPE(dst) == IS_STRING) {
+				zval_dtor(op);
 				ZVAL_COPY_VALUE(op, &dst);
 			} else {
 				zend_error(E_NOTICE, "Object of class %s to string conversion", Z_OBJCE_P(op)->name->val);
+				zval_dtor(op);
 				ZVAL_NEW_STR(op, STR_INIT("Object", sizeof("Object")-1, 0));
 			}
 			break;