From: Xinchen Hui <laruence@php.net>
Date: Tue, 28 Oct 2014 09:36:03 +0000 (+0800)
Subject: Fixed bug #68252 (segfault in Zend/zend_hash.c in function _zend_hash_del_el)
X-Git-Tag: PRE_PHP7_REMOVALS~87^2~72
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e6fe3127d0e02a58456fef1af969a8f114f85c31;p=php

Fixed bug #68252 (segfault in Zend/zend_hash.c in function _zend_hash_del_el)

Don't leave a UNDEF gap in function_table
---

diff --git a/NEWS b/NEWS
index 1c9fd616ef..56441a8791 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,8 @@ PHP                                                                        NEWS
   . Update the MIME type list from the one shipped by Apache HTTPD. (Adam)
 
 - Core:
+  . Fixed bug #68252 (segfault in Zend/zend_hash.c in function
+    _zend_hash_del_el). (Laruence)
   . Added PHP_INT_MIN constant. (Andrea)
   . Added Closure::call() method. (Andrea)
   . Implemented FR #38409 (parse_ini_file() looses the type of booleans). (Tjerk)
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 8203d39e51..940cdefc81 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1830,6 +1830,7 @@ ZEND_FUNCTION(create_function)
 			RETURN_FALSE;
 		}
 		(*func->refcount)++;
+		zend_hash_str_del(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME)-1);
 
 		function_name = zend_string_alloc(sizeof("0lambda_")+MAX_LENGTH_OF_LONG, 0);
 		function_name->val[0] = '\0';
@@ -1839,7 +1840,6 @@ ZEND_FUNCTION(create_function)
 		} while (zend_hash_add_ptr(EG(function_table), function_name, func) == NULL);
 		static_variables = func->static_variables;
 		func->static_variables = NULL;
-		zend_hash_str_del(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME)-1);
 		func->static_variables = static_variables;
 		RETURN_STR(function_name);
 	} else {
diff --git a/ext/opcache/tests/bug68252.phpt b/ext/opcache/tests/bug68252.phpt
new file mode 100644
index 0000000000..e05467a244
--- /dev/null
+++ b/ext/opcache/tests/bug68252.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #68252 (segfault in Zend/zend_hash.c in function _zend_hash_del_el)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.fast_shutdown=1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+/* run this test script with valgrind */
+function a() {
+	echo "okey";
+}
+
+create_function('', 'var_dump("22");');
+
+a();
+--EXPECT--
+okey