From: Xinchen Hui <laruence@php.net>
Date: Sat, 25 Feb 2012 04:36:08 +0000 (+0000)
Subject: Fixed bug #61165 (Segfault - strip_tags())
X-Git-Tag: php-5.5.0alpha1~507
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cfa9c90b20637796dcf97bd14a9926a102bec9de;p=php

Fixed bug #61165 (Segfault - strip_tags())
---

diff --git a/NEWS b/NEWS
index 5a5063d5ce..0316a82393 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ PHP                                                                        NEWS
   . World domination
 
 - Core:
+  . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
   . Fixed bug #61072 (Memory leak when restoring an exception handler).
     (Nikic, Laruence)
   . Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical 
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index e6560b224b..4c0e0f6b2f 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -262,12 +262,17 @@ ZEND_API int zend_get_object_classname(const zval *object, const char **class_na
 static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type TSRMLS_DC) /* {{{ */
 {
 	if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
-		SEPARATE_ZVAL_IF_NOT_REF(arg);
-		if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type TSRMLS_CC) == SUCCESS) {
+		zval *obj;
+		ALLOC_ZVAL(obj);
+		MAKE_COPY_ZVAL(arg, obj);
+		if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, type TSRMLS_CC) == SUCCESS) {
+			zval_ptr_dtor(arg);
+			*arg = obj;
 			*pl = Z_STRLEN_PP(arg);
 			*p = Z_STRVAL_PP(arg);
 			return SUCCESS;
 		}
+		zval_ptr_dtor(&obj);
 	}
 	/* Standard PHP objects */
 	if (Z_OBJ_HT_PP(arg) == &std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) {