From: Xinchen Hui <laruence@gmail.com>
Date: Tue, 15 Apr 2014 06:38:38 +0000 (+0800)
Subject: Fixed invaid write/read
X-Git-Tag: POST_PHPNG_MERGE~412^2~95
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8bfc03734813a54fa8e98a83609e56ad1aa0b6e0;p=php

Fixed invaid write/read
---

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index c98df426c1..632d55b421 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -457,7 +457,7 @@ static int sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_bool
 	int				new_value = 0;
 	long            cnt = 0;
 	int				retval = SUCCESS;
-	zval            tmp_zv, trim_zv, value_copy;
+	zval            tmp_zv, trim_zv, zval_copy;
 
 	sxe = Z_SXEOBJ_P(object);
 
@@ -535,7 +535,7 @@ static int sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_bool
 			case IS_OBJECT:
 				if (Z_OBJCE_P(value) == sxe_class_entry) {
 					//???
-					value = sxe_get_value(value, value TSRMLS_CC);
+					value = sxe_get_value(value, &zval_copy TSRMLS_CC);
 					//INIT_PZVAL(value);
 					new_value = 1;
 					break;
@@ -657,9 +657,6 @@ next_iter:
 	if (pnewnode) {
 		*pnewnode = newnode;
 	}
-	if (value && value == &value_copy) {
-		zval_ptr_dtor(value);
-	}
 	if (new_value) {
 		zval_ptr_dtor(value);
 	}
@@ -816,9 +813,9 @@ static int sxe_prop_dim_exists(zval *object, zval *member, int check_empty, zend
 			}
 			if (node) {
 				exists = 1;
-                                if (check_empty == 1 &&
+				if (check_empty == 1 &&
 					(!node->children || (node->children->type == XML_TEXT_NODE && !node->children->next &&
-						(!node->children->content || !node->children->content[0] || !xmlStrcmp(node->children->content, "0")))) ) {
+					 (!node->children->content || !node->children->content[0] || !xmlStrcmp(node->children->content, "0")))) ) {
 					exists = 0;
 				}
 			}