diff options
| author | Xinchen Hui <laruence@php.net> | 2015-03-01 23:20:22 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2015-03-01 23:20:22 +0800 |
| commit | 9dac9237ab46799e595838ab7821f26de13dc282 (patch) | |
| tree | 6f584a2c5e5f1966807dadbd891bcde913fffb21 | |
| parent | ddd9411f04c8193340e554a8b2ea399143d12db0 (diff) | |
| parent | 169ac35c66220b7c148dd96e70c691549f188b24 (diff) | |
| download | php-git-9dac9237ab46799e595838ab7821f26de13dc282.tar.gz | |
Merge branch 'PHP-5.6'
Conflicts:
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
| -rw-r--r-- | ext/standard/tests/serialize/bug69139.phpt | 10 | ||||
| -rw-r--r-- | ext/standard/var.c | 2 |
2 files changed, 11 insertions, 1 deletions
diff --git a/ext/standard/tests/serialize/bug69139.phpt b/ext/standard/tests/serialize/bug69139.phpt new file mode 100644 index 0000000000..48127a2461 --- /dev/null +++ b/ext/standard/tests/serialize/bug69139.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #69139 (Crash in gc_zval_possible_root on unserialize) +--FILE-- +<?php +$str = 'a:1126666:{i:0;r:1;i:-09610;r:1;i:-0;i:0;i:0;O:1:"A":2119X:i:0;i:0;i:0;i:0;i:0;O:1:"A":2116:{i:0;r:5;i:-096766610;r:1;i:-610;r:1;i:0;i:0;'; +@unserialize($str); +echo "Alive"; +?> +--EXPECT-- +Alive diff --git a/ext/standard/var.c b/ext/standard/var.c index 5e986d451d..1c5a000c25 100644 --- a/ext/standard/var.c +++ b/ext/standard/var.c @@ -1036,7 +1036,7 @@ PHP_FUNCTION(unserialize) zend_hash_destroy(class_hash); FREE_HASHTABLE(class_hash); } - zval_dtor(return_value); + zval_ptr_dtor(return_value); if (!EG(exception)) { php_error_docref(NULL, E_NOTICE, "Error at offset " ZEND_LONG_FMT " of %d bytes", (zend_long)((char*)p - buf), buf_len); } |