summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDmitry Stogov <dmitry@zend.com>2012-10-26 09:47:30 -0700
committerDmitry Stogov <dmitry@zend.com>2012-10-26 09:47:30 -0700
commit68b229ea73b5e975951b5ad02ffb315ec60fca1e (patch)
tree8fa7b0190a23201e9becf4d3c350dabb98d3430f
parentf2bffdc2e48174e38a059d425953e8b1c08dd4bf (diff)
downloadphp-git-68b229ea73b5e975951b5ad02ffb315ec60fca1e.tar.gz
Fixed bug #63180 (Corruption of hash tables)
-rw-r--r--NEWS1
-rw-r--r--ext/pcre/php_pcre.c18
2 files changed, 19 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index c846798da9..d95f5f4293 100644
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,7 @@ PHP NEWS
(Chris Jones)
- PCRE:
+ . Fixed bug #63180 (Corruption of hash tables). (Dmitry)
. Fixed bug #63055 (Segfault in zend_gc with SF2 testsuite).
(Dmitry, Laruence)
. Fixed bug #63284 (Upgrade PCRE to 8.31). (Anatoliy)
diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index f61364cde9..2f892c8e94 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -248,6 +248,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
#endif
pcre_cache_entry *pce;
pcre_cache_entry new_entry;
+ char *tmp = NULL;
/* Try to lookup the cached regex entry, and if successful, just pass
back the compiled pattern, otherwise go on and compile it. */
@@ -438,9 +439,26 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
new_entry.locale = pestrdup(locale, 1);
new_entry.tables = tables;
#endif
+
+ /*
+ * Interned strings are not duplicated when stored in HashTable,
+ * but all the interned strings created during HTTP request are removed
+ * at end of request. However PCRE_G(pcre_cache) must be consistent
+ * on the next request as well. So we disable usage of interned strings
+ * as hash keys especually for this table.
+ * See bug #63180
+ */
+ if (IS_INTERNED(regex)) {
+ regex = tmp = estrndup(regex, regex_len);
+ }
+
zend_hash_update(&PCRE_G(pcre_cache), regex, regex_len+1, (void *)&new_entry,
sizeof(pcre_cache_entry), (void**)&pce);
+ if (tmp) {
+ efree(tmp);
+ }
+
return pce;
}
/* }}} */