From: Antony Dovgal <tony2001@php.net>
Date: Fri, 7 Apr 2006 22:53:34 +0000 (+0000)
Subject: MF51: fix memory corruptions and leaks when cloning ArrayObjects and ArrayIterators
X-Git-Tag: RELEASE_1_3~126
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7cf30db27efdaf299c60066fdfaacaec94011dd9;p=php

MF51: fix memory corruptions and leaks when cloning ArrayObjects and ArrayIterators
---

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index eae99fb258..6d70b450a4 100755
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -149,10 +149,12 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
 		if (clone_orig) {
 			intern->array = other->array;
 			if (Z_OBJ_HT_P(orig) == &spl_handler_ArrayObject) {
-				ZVAL_ADDREF(intern->array);
-				SEPARATE_ZVAL(&intern->array);
+				MAKE_STD_ZVAL(intern->array);
+				array_init(intern->array);
+				zend_hash_copy(HASH_OF(intern->array), HASH_OF(other->array), (copy_ctor_func_t) zval_add_ref, &tmp, sizeof(zval*));
+			}
+			if (Z_OBJ_HT_P(orig) == &spl_handler_ArrayIterator) {
 				ZVAL_ADDREF(other->array);
-				ZVAL_ADDREF(intern->array);
 			}
 		} else {
 			intern->array = orig;