From: Xinchen Hui <laruence@php.net>
Date: Mon, 19 Dec 2011 09:58:29 +0000 (+0000)
Subject: Fixed bug #60558 (Invalid read and writes)
X-Git-Tag: php-5.4.0RC4~8
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d589d33468e5c960d5a598dcb17017d38650793b;p=php

Fixed bug #60558 (Invalid read and writes)
---

diff --git a/NEWS b/NEWS
index 8ae70e81eb..79c2f2f2ac 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP                                                                        NEWS
   . Fixed bug #60536 (Traits Segfault). (Laruence)
   . Fixed bug #60362 (non-existent sub-sub keys should not have values).
     (Laruence, alan_k, Stas)
+  . Fixed bug #60558 (Invalid read and writes). (Laruence)
 
 - CLI SAPI:
   . Fixed bug #60477 (Segfault after two multipart/form-data POST requests,
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index d524c23faa..152a86243a 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -85,6 +85,7 @@ ZEND_API void rebuild_object_properties(zend_object *zobj) /* {{{ */
 					    prop_info->offset >= 0 &&
 						zobj->properties_table[prop_info->offset]) {
 						if (UNEXPECTED(flags[prop_info->offset])) {
+							Z_ADDREF_P(*(zval **)zobj->properties_table[prop_info->offset]);
 							zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]);
 						} else {
 							zend_hash_quick_add(zobj->properties, prop_info->name, prop_info->name_length+1, prop_info->h, (void**)&zobj->properties_table[prop_info->offset], sizeof(zval*), (void**)&zobj->properties_table[prop_info->offset]);