diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2003-11-19 00:41:14 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2003-11-19 00:41:14 +0000 |
| commit | fdd902f0ddc71864116663aa406ae43f0e017108 (patch) | |
| tree | bef64e3129e36b4697fdb2d8022cf0923b0561ca | |
| parent | a16ca5a1c283f2410120b3fe771b0b7948c8acb7 (diff) | |
| download | php-git-fdd902f0ddc71864116663aa406ae43f0e017108.tar.gz | |
Possible fix for bug #26281 & test case.
| -rwxr-xr-x | Zend/tests/bug26281.phpt | 13 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 2 |
2 files changed, 15 insertions, 0 deletions
diff --git a/Zend/tests/bug26281.phpt b/Zend/tests/bug26281.phpt new file mode 100755 index 0000000000..a3a735a552 --- /dev/null +++ b/Zend/tests/bug26281.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #26281 (switch() crash when condition is a string offset) +--FILE-- +<?php + $x = 'abc'; + switch ($x{0}) { + case 'a': + echo "no crash\n"; + break; + } +?> +--EXPECT-- +no crash diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 51b27c0798..19e44bf23e 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -200,7 +200,9 @@ static inline void zend_switch_free(zend_op *opline, temp_variable *Ts TSRMLS_DC * quick & silent get_zval_ptr, and FREE_OP */ PZVAL_UNLOCK(T->EA.data.str_offset.str); +#ifdef ilia_0 /* attempts to free already freed data */ zval_dtor(&T->tmp_var); +#endif } else { zval_ptr_dtor(&T(opline->op1.u.var).var.ptr); if (opline->extended_value) { /* foreach() free */ |