From: Marcus Boerger <helly@php.net>
Date: Fri, 8 Apr 2005 14:36:39 +0000 (+0000)
Subject: - MFH Fix memory corruption
X-Git-Tag: php-5.0.5RC1~458
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a16a9a753ee2f933bcaa719ce7800f0dce651c11;p=php

- MFH Fix memory corruption
---

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 126fc4bc57..4f1c4d7010 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -1284,24 +1284,26 @@ static inline void zend_free_obj_get_result(zval *op, int free_op)
 }
 
 #define COMPARE_RETURN_AND_FREE(retval) \
-			zend_free_obj_get_result(op1, free_op1); \
-			zend_free_obj_get_result(op2, free_op2); \
+			zend_free_obj_get_result(op1_orig, free_op1); \
+			zend_free_obj_get_result(op2_orig, free_op2); \
 			return retval;
 
 ZEND_API int compare_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 {
 	zval op1_copy, op2_copy;
 	zend_bool free_op1 = 0, free_op2 = 0;
+	zval *op1_orig, *op2_orig;
 	
 	if (op1->type == IS_OBJECT && Z_OBJ_HT_P(op1)->get) {
 		op1 = Z_OBJ_HT_P(op1)->get(op1 TSRMLS_CC);
 		free_op1 = 1;
 	}
+	op1_orig = op1;
 	if (op2->type == IS_OBJECT && Z_OBJ_HT_P(op2)->get) {
 		op2 = Z_OBJ_HT_P(op2)->get(op2 TSRMLS_CC);
 		free_op2 = 1;
 	}
-
+	op2_orig = op2;
 
 	if ((op1->type == IS_NULL && op2->type == IS_STRING)
 		|| (op2->type == IS_NULL && op1->type == IS_STRING)) {