From 9faaef0d08fc424794fc2a2749389c4685ff8ab1 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 22 Dec 2005 07:54:19 +0000
Subject: [PATCH] Fixed memory corruption

---
 ext/ctype/ctype.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/ext/ctype/ctype.c b/ext/ctype/ctype.c
index 53420058b6..d863783ff3 100644
--- a/ext/ctype/ctype.c
+++ b/ext/ctype/ctype.c
@@ -92,7 +92,7 @@ PHP_MINFO_FUNCTION(ctype)
 /* {{{ ctype
  */
 #define CTYPE(iswhat) \
-	zval *c; \
+	zval *c, tmp; \
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z", &c) == FAILURE) \
 		return; \
  	switch (Z_TYPE_P(c)) { \
@@ -102,23 +102,33 @@ PHP_MINFO_FUNCTION(ctype)
 		} else if (Z_LVAL_P(c) >= -128 && Z_LVAL_P(c) < 0) { \
 			RETURN_BOOL(iswhat(Z_LVAL_P(c) + 256)); \
 		} \
-		SEPARATE_ZVAL(&c);	\
-		convert_to_string(c);	\
+		tmp = *c; \
+		zval_copy_ctor(&tmp); \
+		convert_to_string(&tmp); \
+		c = &tmp; \
 	case IS_STRING: \
 	case IS_BINARY: \
 string:\
 		{ \
 			char *p = Z_STRVAL_P(c), *e = Z_STRVAL_P(c) + Z_STRLEN_P(c); \
 			if (e == p) {	\
+				if (c == &tmp) zval_dtor(&tmp); \
 				RETURN_FALSE;	\
 			}	\
 			while (p < e) { \
-				if(!iswhat((int)*(unsigned char *)(p++))) RETURN_FALSE; \
+				if(!iswhat((int)*(unsigned char *)(p++))) { \
+					if (c == &tmp) zval_dtor(&tmp); \
+					RETURN_FALSE; \
+				} \
 			} \
+			if (c == &tmp) zval_dtor(&tmp); \
 			RETURN_TRUE; \
 		} \
 	case IS_UNICODE: \
-		convert_to_string(c); \
+		tmp = *c; \
+		zval_copy_ctor(&tmp); \
+		convert_to_string(&tmp); \
+		c = &tmp; \
 		goto string; \
 	default: \
 		break; \
-- 
2.40.0