summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorXinchen Hui <laruence@php.net>2012-02-25 04:36:08 (GMT)
committerXinchen Hui <laruence@php.net>2012-02-25 04:36:08 (GMT)
commitcfa9c90b20637796dcf97bd14a9926a102bec9de (patch)
treee6e3780c8f9d50e401019127f1e269b85aa48fb3
parentc1322d2505ca015f57b1d79da4e8960b2a0f4a1e (diff)
downloadphp-cfa9c90b20637796dcf97bd14a9926a102bec9de.tar.gz
Fixed bug #61165 (Segfault - strip_tags())
-rw-r--r--NEWS1
-rw-r--r--Zend/zend_API.c9
2 files changed, 8 insertions, 2 deletions
diff --git a/NEWS b/NEWS
index 5a5063d..0316a82 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ PHP NEWS
. World domination
- Core:
+ . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
. Fixed bug #61072 (Memory leak when restoring an exception handler).
(Nikic, Laruence)
. Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index e6560b2..4c0e0f6 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -262,12 +262,17 @@ ZEND_API int zend_get_object_classname(const zval *object, const char **class_na
static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type TSRMLS_DC) /* {{{ */
{
if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
- SEPARATE_ZVAL_IF_NOT_REF(arg);
- if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type TSRMLS_CC) == SUCCESS) {
+ zval *obj;
+ ALLOC_ZVAL(obj);
+ MAKE_COPY_ZVAL(arg, obj);
+ if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, type TSRMLS_CC) == SUCCESS) {
+ zval_ptr_dtor(arg);
+ *arg = obj;
*pl = Z_STRLEN_PP(arg);
*p = Z_STRVAL_PP(arg);
return SUCCESS;
}
+ zval_ptr_dtor(&obj);
}
/* Standard PHP objects */
if (Z_OBJ_HT_PP(arg) == &std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) {