diff options
| author | Antony Dovgal <tony2001@php.net> | 2009-02-11 09:58:58 +0000 |
|---|---|---|
| committer | Antony Dovgal <tony2001@php.net> | 2009-02-11 09:58:58 +0000 |
| commit | 120b469bb41e710dfefcc65edfe25721aef41aed (patch) | |
| tree | 1f6bc49b9439a91afb79ea6fd1f83c08b8f1324a | |
| parent | 49cf106aa43307c40cacb99051fc09d4f564e1b2 (diff) | |
| download | php-git-120b469bb41e710dfefcc65edfe25721aef41aed.tar.gz | |
MFH: fix bug #47353 (crash when creating a lot of objects in object destructor)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | Zend/zend_objects_API.c | 6 |
2 files changed, 8 insertions, 0 deletions
@@ -1,6 +1,8 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Feb 2009, PHP 5.2.9 +- Fixed bug #47353 (crash when creating a lot of objects in object destructor). + (Tony) - Fixed bug #47322 (sscanf %d doesn't work). (Felipe) - Fixed bug #46026 (bz2.decompress/zlib.inflate filter tries to decompress after end of stream). (Greg) diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c index 4e49ea244a..7b73ab33c2 100644 --- a/Zend/zend_objects_API.c +++ b/Zend/zend_objects_API.c @@ -55,6 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS if (obj->dtor && obj->object) { obj->refcount++; obj->dtor(obj->object, i TSRMLS_CC); + obj = &objects->object_buckets[i].bucket.obj; obj->refcount--; } } @@ -200,6 +201,10 @@ ZEND_API void zend_objects_store_del_ref_by_handle(zend_object_handle handle TSR } zend_end_try(); } } + + /* re-read the object from the object store as the store might have been reallocated in the dtor */ + obj = &EG(objects_store).object_buckets[handle].bucket.obj; + if (obj->refcount == 1) { if (obj->free_storage) { zend_try { @@ -241,6 +246,7 @@ ZEND_API zend_object_value zend_objects_store_clone_obj(zval *zobject TSRMLS_DC) } obj->clone(obj->object, &new_object TSRMLS_CC); + obj = &EG(objects_store).object_buckets[handle].bucket.obj; retval.handle = zend_objects_store_put(new_object, obj->dtor, obj->free_storage, obj->clone TSRMLS_CC); retval.handlers = Z_OBJ_HT_P(zobject); |