diff options
| author | Dmitry Stogov <dmitry@php.net> | 2010-09-30 14:11:51 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2010-09-30 14:11:51 +0000 |
| commit | 5c6f0ebeabd5ee4d8bd79f158fd7ee968ac28c0d (patch) | |
| tree | 2ec0d2119402c443c02e94177bf35390efd576ea | |
| parent | 104bf57ae78f9e0f573aee930be6953a25c82dcd (diff) | |
| download | php-git-5c6f0ebeabd5ee4d8bd79f158fd7ee968ac28c0d.tar.gz | |
Prevented crash in GC because of incorrect reference counting
| -rw-r--r-- | Zend/tests/gc_032.phpt | 40 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 2 |
2 files changed, 41 insertions, 1 deletions
diff --git a/Zend/tests/gc_032.phpt b/Zend/tests/gc_032.phpt new file mode 100644 index 0000000000..615b008e65 --- /dev/null +++ b/Zend/tests/gc_032.phpt @@ -0,0 +1,40 @@ +--TEST-- +GC 032: Crash in GC because of invalid reference counting +--FILE-- +<?php +$a = array(); +$b =& $a; +$a[0] = $a; +debug_zval_dump($a); +$a = array(array()); +$b =& $a; +$a[0][0] = $a; +debug_zval_dump($a); +?> +--EXPECT-- +array(1) refcount(1){ + [0]=> + array(1) refcount(3){ + [0]=> + array(1) refcount(3){ + [0]=> + *RECURSION* + } + } +} +array(1) refcount(1){ + [0]=> + array(1) refcount(3){ + [0]=> + array(1) refcount(1){ + [0]=> + array(1) refcount(3){ + [0]=> + array(1) refcount(1){ + [0]=> + *RECURSION* + } + } + } + } +} diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 5ddb03a8c3..2d9a8cdd58 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -714,8 +714,8 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value ALLOC_ZVAL(variable_ptr); *variable_ptr_ptr = variable_ptr; *variable_ptr = *value; - zval_copy_ctor(variable_ptr); Z_SET_REFCOUNT_P(variable_ptr, 1); + zval_copy_ctor(variable_ptr); } else { *variable_ptr_ptr = value; Z_ADDREF_P(value); |