From 03b6daed4fd9b42bc3d6ff40dabf9661024664b4 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Thu, 7 Apr 2011 13:35:27 +0000 Subject: [PATCH] Fixed bug #54372 (Crash accessing global object itself returned from its __get() handle) --- NEWS | 2 ++ Zend/zend_object_handlers.c | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index eaaff79520..801611684f 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,8 @@ PHP NEWS - Zend Engine: . Fixed bug #54423 (classes from dl()'ed extensions are not destroyed). (Tony, Dmitry) + . Fixed bug #54372 (Crash accessing global object itself returned from its + __get() handle). (Dmitry) . Fixed bug #54262 (Crash when assigning value to a dimension in a non-array). (Dmitry) diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index ac373aeb6f..2fd097b662 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -374,7 +374,11 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /* } else { retval = &EG(uninitialized_zval_ptr); } - zval_ptr_dtor(&object); + if (EXPECTED(*retval != object)) { + zval_ptr_dtor(&object); + } else { + Z_DELREF_P(object); + } } else { if (zobj->ce->__get && guard && guard->in_get == 1) { if (Z_STRVAL_P(member)[0] == '\0') { -- 2.40.0