diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-03-20 04:52:57 -0700 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-03-20 04:52:57 -0700 |
| commit | 9564998e490092fdefa6630944e38692c75e30de (patch) | |
| tree | 0ff4cf199dc92979a924221ed4c1bf863fd081a4 /Zend/zend_objects_API.c | |
| parent | 8023204d219d353b83f19edb0133483d67aedcfb (diff) | |
| download | php-git-9564998e490092fdefa6630944e38692c75e30de.tar.gz | |
Fixed Bug #71859 (zend_objects_store_call_destructors operates on realloced memory, crashing)
Diffstat (limited to 'Zend/zend_objects_API.c')
| -rw-r--r-- | Zend/zend_objects_API.c | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c index 6ca190eabe..00d9425f18 100644 --- a/Zend/zend_objects_API.c +++ b/Zend/zend_objects_API.c @@ -44,12 +44,9 @@ ZEND_API void zend_objects_store_destroy(zend_objects_store *objects) ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects) { if (objects->top > 1) { - zend_object **obj_ptr = objects->object_buckets + 1; - zend_object **end = objects->object_buckets + objects->top; - - do { - zend_object *obj = *obj_ptr; - + uint32_t i; + for (i = 1; i < objects->top; i++) { + zend_object *obj = objects->object_buckets[i]; if (IS_OBJ_VALID(obj)) { if (!(GC_FLAGS(obj) & IS_OBJ_DESTRUCTOR_CALLED)) { GC_FLAGS(obj) |= IS_OBJ_DESTRUCTOR_CALLED; @@ -58,8 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects) GC_REFCOUNT(obj)--; } } - obj_ptr++; - } while (obj_ptr != end); + } } } |