diff options
| author | Xinchen Hui <laruence@gmail.com> | 2018-08-07 12:36:36 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2018-08-07 12:36:36 +0800 |
| commit | 2b1d79ce6661efdfae881884ca40b4ca7fc991e7 (patch) | |
| tree | 7f9f44f9e18963e446ddeacf34272a6432ae18b6 /ext/standard/array.c | |
| parent | b053beee7efb64b8e439fb3639de839e615ba89c (diff) | |
| download | php-git-2b1d79ce6661efdfae881884ca40b4ca7fc991e7.tar.gz | |
Fixed bug #76713 (Segmentation fault caused by property corruption)
Diffstat (limited to 'ext/standard/array.c')
| -rw-r--r-- | ext/standard/array.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ext/standard/array.c b/ext/standard/array.c index ed917d71d0..187b7182a4 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -4113,6 +4113,9 @@ static inline zval *array_column_fetch_prop(zval *data, zval *name, zval *rv) /* prop = Z_OBJ_HANDLER_P(data, read_property)(data, name, BP_VAR_R, NULL, rv); if (prop) { ZVAL_DEREF(prop); + if (prop != rv) { + Z_TRY_ADDREF_P(prop); + } } } } else if (Z_TYPE_P(data) == IS_ARRAY) { |