diff options
| author | Stanislav Malyshev <stas@php.net> | 2014-06-10 23:17:30 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2014-06-10 23:24:11 -0700 |
| commit | 2b04d689724bdfd5db9351c017566e2f51d61568 (patch) | |
| tree | 5085b4a2365202265c90f50e27794d1902d1b630 /ext/spl/spl_array.c | |
| parent | 0235a8acdc9b99d4d3d4dd107b75d7eb6ca0ef97 (diff) | |
| download | php-git-php-5.4.30RC1.tar.gz | |
Fix bug #66127 (Segmentation fault with ArrayObject unset)php-5.4.30RC1
Diffstat (limited to 'ext/spl/spl_array.c')
| -rw-r--r-- | ext/spl/spl_array.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 34f3a3818d..758947a8cc 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -402,7 +402,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval /* When in a write context, * ZE has to be fooled into thinking this is in a reference set * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */ - if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) { + if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret) && ret != &EG(uninitialized_zval_ptr)) { if (Z_REFCOUNT_PP(ret) > 1) { zval *newval; |