From: Matteo Beccati <mbeccati@php.net>
Date: Fri, 13 Jun 2014 11:14:12 +0000 (+0200)
Subject: Fix bug #67433 SIGSEGV when using count() on an object implementing Countable
X-Git-Tag: PRE_PHPNG_MERGE~192^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=df5551ba4f1aae8486b3c4011318188fde7e30cd;p=php

Fix bug #67433 SIGSEGV when using count() on an object implementing Countable
---

diff --git a/NEWS b/NEWS
index 490ccea7a6..38a05790df 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
   . Fixed bug #67392 (dtrace breaks argument unpack). (Nikita)
   . Fixed bug #67428 (header('Location: foo') will override a 308-399 response
     code). (Adam)
+  . Fixed bug #67433 (SIGSEGV when using count() on an object implementing
+    Countable). (Matteo)
 
 - CLI server:
   . Implemented FR #67429 (CLI server is missing some new HTTP response codes).
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4f98331035..cbcaaf5b8b 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -342,8 +342,7 @@ PHP_FUNCTION(count)
 					RETVAL_LONG(Z_LVAL_P(retval));
 					zval_ptr_dtor(&retval);
 				}
-				zval_dtor(mode_zv);
-				efree(mode_zv);
+				zval_ptr_dtor(&mode_zv);
 				return;
 			}
 #endif