From: Dmitry Stogov <dmitry@php.net>
Date: Fri, 11 Jun 2010 08:53:31 +0000 (+0000)
Subject: Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues)
X-Git-Tag: php-5.3.3RC1~38
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d24c14cb5944167e413751963a608030f76c1ae9;p=php

Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues)
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index f4fef53ecb..501ced13cf 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1057,6 +1057,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 	/* Set up known arguments */
 	args[1] = &key;
 	args[2] = userdata;
+	if (userdata) {
+		Z_ADDREF_PP(userdata);
+	}
 
 	zend_hash_internal_pointer_reset_ex(target_hash, &pos);
 
@@ -1076,6 +1079,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 			thash = Z_ARRVAL_PP(args[0]);
 			if (thash->nApplyCount > 1) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
+				if (userdata) {
+					zval_ptr_dtor(userdata);
+				}
 				return 0;
 			}
 
@@ -1126,6 +1132,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 		zend_hash_move_forward_ex(target_hash, &pos);
 	}
 
+	if (userdata) {
+		zval_ptr_dtor(userdata);
+	}
 	return 0;
 }
 /* }}} */
diff --git a/ext/standard/tests/array/bug51552.phpt b/ext/standard/tests/array/bug51552.phpt
new file mode 100644
index 0000000000..fb61f489b0
--- /dev/null
+++ b/ext/standard/tests/array/bug51552.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues)
+--FILE--
+<?php
+function walk($element, $key, $p) {
+    $backtrace = debug_backtrace();
+    echo "$element\n";
+}
+
+$a = array(1,2,3,4,5,6,7,8,9,10);
+array_walk($a, 'walk', 'testthis');
+?>
+--EXPECT--
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10