diff options
| -rw-r--r-- | ext/standard/tests/serialize/bug69139.phpt | 10 | ||||
| -rw-r--r-- | ext/standard/var.c | 2 |
2 files changed, 11 insertions, 1 deletions
diff --git a/ext/standard/tests/serialize/bug69139.phpt b/ext/standard/tests/serialize/bug69139.phpt new file mode 100644 index 0000000000..48127a2461 --- /dev/null +++ b/ext/standard/tests/serialize/bug69139.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #69139 (Crash in gc_zval_possible_root on unserialize) +--FILE-- +<?php +$str = 'a:1126666:{i:0;r:1;i:-09610;r:1;i:-0;i:0;i:0;O:1:"A":2119X:i:0;i:0;i:0;i:0;i:0;O:1:"A":2116:{i:0;r:5;i:-096766610;r:1;i:-610;r:1;i:0;i:0;'; +@unserialize($str); +echo "Alive"; +?> +--EXPECT-- +Alive diff --git a/ext/standard/var.c b/ext/standard/var.c index 5e986d451d..1c5a000c25 100644 --- a/ext/standard/var.c +++ b/ext/standard/var.c @@ -1036,7 +1036,7 @@ PHP_FUNCTION(unserialize) zend_hash_destroy(class_hash); FREE_HASHTABLE(class_hash); } - zval_dtor(return_value); + zval_ptr_dtor(return_value); if (!EG(exception)) { php_error_docref(NULL, E_NOTICE, "Error at offset " ZEND_LONG_FMT " of %d bytes", (zend_long)((char*)p - buf), buf_len); } |