From 4e291fab81eb8c7517d673705ae8a46bf178724b Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Thu, 10 Jul 2014 21:45:09 +0400 Subject: [PATCH] Fixed usage after free() --- Zend/zend_operators.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c index 4e7b479bda..76c732732e 100644 --- a/Zend/zend_operators.c +++ b/Zend/zend_operators.c @@ -627,12 +627,13 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC) /* {{{ */ TSRMLS_FETCH(); convert_object_to_type(op, &dst, IS_STRING, convert_to_string); - zval_dtor(op); if (Z_TYPE(dst) == IS_STRING) { + zval_dtor(op); ZVAL_COPY_VALUE(op, &dst); } else { zend_error(E_NOTICE, "Object of class %s to string conversion", Z_OBJCE_P(op)->name->val); + zval_dtor(op); ZVAL_NEW_STR(op, STR_INIT("Object", sizeof("Object")-1, 0)); } break; -- 2.50.1