diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2016-04-04 09:35:48 +0300 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@zend.com> | 2016-04-04 09:35:48 +0300 |
| commit | e7730fece6bc68bc3c2835c3fd3da4999496878c (patch) | |
| tree | 30ce73b97c7bd61e4dca95202a55aa3767d3ee3b /Zend/zend_generators.c | |
| parent | f1fca16f7ad74ad221f1caf45294cb9886a1f487 (diff) | |
| download | php-git-e7730fece6bc68bc3c2835c3fd3da4999496878c.tar.gz | |
Fised possible use-after-free
Diffstat (limited to 'Zend/zend_generators.c')
| -rw-r--r-- | Zend/zend_generators.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c index 8dfa2a9754..cbcc774c5e 100644 --- a/Zend/zend_generators.c +++ b/Zend/zend_generators.c @@ -334,8 +334,9 @@ ZEND_API void zend_generator_create_zval(zend_execute_data *call, zend_op_array object_init_ex(return_value, zend_ce_generator); - if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) { - Z_ADDREF(call->This); + if (Z_TYPE(EX(This)) == IS_OBJECT && !(EX_CALL_INFO() & ZEND_CALL_CLOSURE)) { + ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_RELEASE_THIS); + Z_ADDREF(EX(This)); } /* Save execution context in generator object. */ |