From 2d8f3f9b72b985fb1fa51b38fda8aa42b564c634 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Tue, 15 Jan 2008 11:53:13 +0000 Subject: [PATCH] Fixed bug #43851 (Memory corrution on reuse of assigned value) --- Zend/tests/bug43851.phpt | 13 +++++++++++++ Zend/zend_execute.c | 4 ++-- 2 files changed, 15 insertions(+), 2 deletions(-) create mode 100644 Zend/tests/bug43851.phpt diff --git a/Zend/tests/bug43851.phpt b/Zend/tests/bug43851.phpt new file mode 100644 index 0000000000..e19e393df0 --- /dev/null +++ b/Zend/tests/bug43851.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #43851 (Memory corrution on reuse of assigned value) +--FILE-- + +--EXPECT-- +ok diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index af7a6d1d07..c131edf99a 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -756,7 +756,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value if (Z_TYPE_P(variable_ptr) == IS_OBJECT && Z_OBJ_HANDLER_P(variable_ptr, set)) { Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr_ptr, value TSRMLS_CC); - return value; + return variable_ptr; } if (PZVAL_IS_REF(variable_ptr)) { @@ -775,7 +775,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value Z_DELREF_P(value); } zendi_zval_dtor(garbage); - return value; + return variable_ptr; } } else { if (Z_DELREF_P(variable_ptr) == 0) { -- 2.40.0