diff options
| author | Xinchen Hui <laruence@gmail.com> | 2014-04-15 14:38:38 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2014-04-15 14:38:38 +0800 |
| commit | 8bfc03734813a54fa8e98a83609e56ad1aa0b6e0 (patch) | |
| tree | 2b25376b5d8ba173ecf9c44263a5ddba4b9483fc | |
| parent | 541842d87a5741dba0eb829ba0346399bbe197fc (diff) | |
| download | php-git-8bfc03734813a54fa8e98a83609e56ad1aa0b6e0.tar.gz | |
Fixed invaid write/read
| -rw-r--r-- | ext/simplexml/simplexml.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c index c98df426c1..632d55b421 100644 --- a/ext/simplexml/simplexml.c +++ b/ext/simplexml/simplexml.c @@ -457,7 +457,7 @@ static int sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_bool int new_value = 0; long cnt = 0; int retval = SUCCESS; - zval tmp_zv, trim_zv, value_copy; + zval tmp_zv, trim_zv, zval_copy; sxe = Z_SXEOBJ_P(object); @@ -535,7 +535,7 @@ static int sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_bool case IS_OBJECT: if (Z_OBJCE_P(value) == sxe_class_entry) { //??? - value = sxe_get_value(value, value TSRMLS_CC); + value = sxe_get_value(value, &zval_copy TSRMLS_CC); //INIT_PZVAL(value); new_value = 1; break; @@ -657,9 +657,6 @@ next_iter: if (pnewnode) { *pnewnode = newnode; } - if (value && value == &value_copy) { - zval_ptr_dtor(value); - } if (new_value) { zval_ptr_dtor(value); } @@ -816,9 +813,9 @@ static int sxe_prop_dim_exists(zval *object, zval *member, int check_empty, zend } if (node) { exists = 1; - if (check_empty == 1 && + if (check_empty == 1 && (!node->children || (node->children->type == XML_TEXT_NODE && !node->children->next && - (!node->children->content || !node->children->content[0] || !xmlStrcmp(node->children->content, "0")))) ) { + (!node->children->content || !node->children->content[0] || !xmlStrcmp(node->children->content, "0")))) ) { exists = 0; } } |