| Dmitry Stogov 2005-09-27, 6:55 pm |
| dmitry Tue Sep 27 14:07:42 2005 EDT
Added files: (Branch: PHP_5_1)
/ZendEngine2/tests bug34617.phpt
Modified files:
/php-src NEWS
/ZendEngine2 zend_objects_API.c
Log:
Fixed bug #34617 (zend_deactivate: objects_store used after zend_objects_store_destroy is called)
http://cvs.php.net/diff.php/php-src....2027.2.82&ty=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.81 php-src/NEWS:1.2027.2.82
--- php-src/NEWS:1.2027.2.81 Tue Sep 27 11:25:09 2005
+++ php-src/NEWS Tue Sep 27 14:07:41 2005
@@ -37,6 +37,8 @@
(Andrey)
- Fixed bug #34645 (ctype corrupts memory when validating large numbers). (Ilia)
- Fixed bug #34643 (wsdl default value has no effect). (Dmitry)
+- Fixed bug #34617 (zend_deactivate: objects_store used after
+ zend_objects_store_destroy is called). (Dmitry)
- Fixed bug #34590 (User defined PDOStatement class can't implement methods).
(Marcus)
- Fixed bug #34584 (Segfault with SPL autoload handler). (Marcus)
http://cvs.php.net/diff.php/ZendEng...2=1.47.2.1&ty=u
Index: ZendEngine2/zend_objects_API.c
diff -u ZendEngine2/zend_objects_API.c:1.47 ZendEngine2/zend_objects_API.c:1.47.2.1
--- ZendEngine2/zend_objects_API.c:1.47 Wed Aug 3 09:30:55 2005
+++ ZendEngine2/zend_objects_API.c Tue Sep 27 14:07:41 2005
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_objects_API.c,v 1.47 2005/08/03 13:30:55 sniper Exp $ */
+/* $Id: zend_objects_API.c,v 1.47.2.1 2005/09/27 18:07:41 dmitry Exp $ */
#include "zend.h"
#include "zend_globals.h"
@@ -38,6 +38,7 @@
ZEND_API void zend_objects_store_destroy(zend_objects_
store *objects)
{
efree(objects->object_buckets);
+ objects->object_buckets = NULL;
}
ZEND_API void zend_objects_store_call_destructors(zend
_objects_store *objects TSRMLS_DC)
@@ -138,9 +139,16 @@
ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
{
- zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
- struct _store_object *obj = &EG(objects_store).object_buckets[handle].bucket.obj;
-
+ zend_object_handle handle;
+ struct _store_object *obj;
+
+ if (!EG(objects_store).object_buckets) {
+ return;
+ }
+
+ handle = Z_OBJ_HANDLE_P(zobject);
+ obj = &EG(objects_store).object_buckets[handle].bucket.obj;
+
/* Make sure we hold a reference count during the destructor call
otherwise, when the destructor ends the storage might be freed
when the refcount reaches 0 a second time
http://cvs.php.net/co.php/ZendEngin....phpt?r=1.1&p=1
Index: ZendEngine2/tests/bug34617.phpt
+++ ZendEngine2/tests/bug34617.phpt
|