From 5b18acdcc917e93ef9470119c034210ad0129de8 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Tue, 11 May 2010 10:41:19 +0000 Subject: Fixed a possible memory corruption because of unexpected call-time pass by refernce and following memory clobbering through callbacks. --- Zend/zend_API.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'Zend/zend_API.c') diff --git a/Zend/zend_API.c b/Zend/zend_API.c index 0b9823a989..49464705da 100644 --- a/Zend/zend_API.c +++ b/Zend/zend_API.c @@ -412,6 +412,12 @@ static char *zend_parse_arg_impl(int arg_num, zval **arg, va_list *va, char **sp case IS_DOUBLE: case IS_BOOL: convert_to_string_ex(arg); + if (UNEXPECTED(Z_ISREF_PP(arg) != 0)) { + /* it's dangerous to return pointers to string + buffer of referenced variable, because it can + be clobbered throug magic callbacks */ + SEPARATE_ZVAL(arg); + } *p = Z_STRVAL_PP(arg); *pl = Z_STRLEN_PP(arg); break; -- cgit v1.2.1