diff options
| author | Xinchen Hui <laruence@php.net> | 2013-06-05 17:25:00 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2013-06-05 17:25:00 +0800 |
| commit | 3c87945c95c9c31986e690bb046c70e58c8d8896 (patch) | |
| tree | c6e6c2c2a91fefa10105cb6815aabea9d5b8e8b7 | |
| parent | 93e0d78ec655f59ebfa82b2c6f8486c43651c1d0 (diff) | |
| download | php-git-3c87945c95c9c31986e690bb046c70e58c8d8896.tar.gz | |
Fixed bug #64960 (Segfault in gc_zval_possible_root)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | Zend/tests/bug64960.phpt | 40 | ||||
| -rw-r--r-- | Zend/zend_execute_API.c | 6 |
3 files changed, 44 insertions, 4 deletions
@@ -1,6 +1,8 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2013, PHP 5.3.27 +- Core: + . Fixed bug #64960 (Segfault in gc_zval_possible_root). (Laruence) - PDO_firebird: . Fixed bug #64037 (Firebird return wrong value for numeric field). diff --git a/Zend/tests/bug64960.phpt b/Zend/tests/bug64960.phpt new file mode 100644 index 0000000000..b31cca3dc6 --- /dev/null +++ b/Zend/tests/bug64960.phpt @@ -0,0 +1,40 @@ +--TEST-- +Bug #64960 (Segfault in gc_zval_possible_root) +--FILE-- +<?php +// this makes ob_end_clean raise an error +ob_end_flush(); + +class ExceptionHandler { + public function __invoke (Exception $e) + { + // this triggers the custom error handler + ob_end_clean(); + } +} + +// this must be a class, closure does not trigger segfault +set_exception_handler(new ExceptionHandler()); + +// exception must be throwed from error handler. +set_error_handler(function() +{ + $e = new Exception; + $e->_trace = debug_backtrace(); + + throw $e; +}); + +// trigger error handler +$a['waa']; +?> +--EXPECTF-- +Notice: ob_end_flush(): failed to delete and flush buffer. No buffer to delete or flush in %sbug64960.php on line 3 + +Fatal error: Uncaught exception 'Exception' in %sbug64960.php:19 +Stack trace: +#0 [internal function]: {closure}(8, 'ob_end_clean():...', '%s', 9, Array) +#1 %sbug64960.php(9): ob_end_clean() +#2 [internal function]: ExceptionHandler->__invoke(Object(Exception)) +#3 {main} + thrown in %sbug64960.php on line 19 diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index 97818895ef..687520d1a4 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -263,15 +263,13 @@ void shutdown_executor(TSRMLS_D) /* {{{ */ if (EG(user_error_handler)) { zeh = EG(user_error_handler); EG(user_error_handler) = NULL; - zval_dtor(zeh); - FREE_ZVAL(zeh); + zval_ptr_dtor(&zeh); } if (EG(user_exception_handler)) { zeh = EG(user_exception_handler); EG(user_exception_handler) = NULL; - zval_dtor(zeh); - FREE_ZVAL(zeh); + zval_ptr_dtor(&zeh); } zend_stack_destroy(&EG(user_error_handlers_error_reporting)); |