diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-06-01 22:06:16 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-06-01 22:07:16 -0700 |
| commit | 1cbd25ca15383394ffa9ee8601c5de4c0f2f90e1 (patch) | |
| tree | fedb81989c69afc9777197e82eca953f53293470 /ext/spl/spl_heap.c | |
| parent | 9031a902e3393ff7dc8a02615430a7d894c740fa (diff) | |
| download | php-git-1cbd25ca15383394ffa9ee8601c5de4c0f2f90e1.tar.gz | |
Fix bug #69737 - Segfault when SplMinHeap::compare produces fatal error
Diffstat (limited to 'ext/spl/spl_heap.c')
| -rw-r--r-- | ext/spl/spl_heap.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c index 02833074fa..fad237932b 100644 --- a/ext/spl/spl_heap.c +++ b/ext/spl/spl_heap.c @@ -249,9 +249,10 @@ static void spl_ptr_heap_insert(spl_ptr_heap *heap, spl_ptr_heap_element elem, v heap->ctor(elem TSRMLS_CC); /* sifting up */ - for(i = heap->count++; i > 0 && heap->cmp(heap->elements[(i-1)/2], elem, cmp_userdata TSRMLS_CC) < 0; i = (i-1)/2) { + for(i = heap->count; i > 0 && heap->cmp(heap->elements[(i-1)/2], elem, cmp_userdata TSRMLS_CC) < 0; i = (i-1)/2) { heap->elements[i] = heap->elements[(i-1)/2]; } + heap->count++; if (EG(exception)) { /* exception thrown during comparison */ |