diff options
| author | Dmitry Stogov <dmitry@php.net> | 2010-05-12 11:32:25 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2010-05-12 11:32:25 +0000 |
| commit | 214d3bc24804adc26238565298b68f4571c3790b (patch) | |
| tree | e5a422ceb2380104944e671ca23cb987737be1d7 | |
| parent | 4ae16d351c5e8078aac616a3d7e9b8c57f189d8c (diff) | |
| download | php-git-214d3bc24804adc26238565298b68f4571c3790b.tar.gz | |
Fixed a possible memory corruption in parse_str(). Reported by Stefan Esser
| -rw-r--r-- | ext/standard/string.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/ext/standard/string.c b/ext/standard/string.c index 250af0702e..8c483d5870 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -4146,11 +4146,13 @@ PHP_FUNCTION(parse_str) Z_ARRVAL(tmp) = EG(active_symbol_table); sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC); } else { + zval ret; + + array_init(&ret); + sapi_module.treat_data(PARSE_STRING, res, &ret TSRMLS_CC); /* Clear out the array that was passed in. */ zval_dtor(arrayArg); - array_init(arrayArg); - - sapi_module.treat_data(PARSE_STRING, res, arrayArg TSRMLS_CC); + ZVAL_COPY_VALUE(arrayArg, &ret); } } /* }}} */ |