diff options
| author | Dmitry Stogov <dmitry@php.net> | 2011-11-18 12:43:53 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2011-11-18 12:43:53 +0000 |
| commit | f7278c161f5882f6b7aadfc83737b1b442e31f58 (patch) | |
| tree | 38e90d098a8aa1408e08cfa263e0150f628354fb /Zend | |
| parent | 092a21cde34dd9daea22f50a45ea91345be2f368 (diff) | |
| download | php-git-f7278c161f5882f6b7aadfc83737b1b442e31f58.tar.gz | |
Fixed bug #60138 (GC crash with referenced array in RecursiveArrayIterator)
Diffstat (limited to 'Zend')
| -rw-r--r-- | Zend/tests/bug60138.phpt | 16 | ||||
| -rw-r--r-- | Zend/zend_execute_API.c | 9 |
2 files changed, 21 insertions, 4 deletions
diff --git a/Zend/tests/bug60138.phpt b/Zend/tests/bug60138.phpt new file mode 100644 index 0000000000..3bf1fba96c --- /dev/null +++ b/Zend/tests/bug60138.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #60138 (GC crash with referenced array in RecursiveArrayIterator) +--FILE-- +<?php +$tree = array(array("f")); +$category =& $tree[0]; + +$iterator = new RecursiveIteratorIterator( + new RecursiveArrayIterator($tree), + RecursiveIteratorIterator::SELF_FIRST +); +foreach($iterator as $file); +echo "ok\n"; +?> +--EXPECT-- +ok diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 8a3ec3b5d0..d5a8d32f23 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -865,10 +865,11 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS && (EX(function_state).function->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) == 0 && !ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 1) && PZVAL_IS_REF(*fci->params[i])) { - SEPARATE_ZVAL(fci->params[i]); - } - - if (ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 1) + ALLOC_ZVAL(param); + *param = **(fci->params[i]); + INIT_PZVAL(param); + zval_copy_ctor(param); + } else if (ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 1) && !PZVAL_IS_REF(*fci->params[i])) { if (Z_REFCOUNT_PP(fci->params[i]) > 1) { |