diff options
| author | Xinchen Hui <laruence@php.net> | 2015-02-25 18:21:59 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2015-02-25 18:21:59 +0800 |
| commit | ffdc5728c8d0c1cc31e2a13d1d7a03e85a85e7f0 (patch) | |
| tree | 7fd6f12c3a3e1031e20d6965cd00a2c12cd3f63b | |
| parent | 1bfbb546f761266a769a3f1f85c26802cc7996a1 (diff) | |
| download | php-git-ffdc5728c8d0c1cc31e2a13d1d7a03e85a85e7f0.tar.gz | |
Fixed bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage)
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/spl/spl_observer.c | 1 | ||||
| -rw-r--r-- | ext/spl/tests/bug69108.phpt | 22 |
3 files changed, 25 insertions, 0 deletions
@@ -36,6 +36,8 @@ PHP NEWS parameters). (Laruence) - SPL: + . Fixed bug #69108 ("Segmentation fault" when (de)serializing + SplObjectStorage). (Laruence) . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()). (Julien) diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c index a7f6132747..5e21088891 100644 --- a/ext/spl/spl_observer.c +++ b/ext/spl/spl_observer.c @@ -782,6 +782,7 @@ SPL_METHOD(SplObjectStorage, serialize) INIT_PZVAL(&members); Z_ARRVAL(members) = zend_std_get_properties(getThis() TSRMLS_CC); Z_TYPE(members) = IS_ARRAY; + zend_hash_del(Z_ARRVAL(members), "\x00gcdata", sizeof("\x00gcdata")); pmembers = &members; php_var_serialize(&buf, &pmembers, &var_hash TSRMLS_CC); /* finishes the string */ diff --git a/ext/spl/tests/bug69108.phpt b/ext/spl/tests/bug69108.phpt new file mode 100644 index 0000000000..1829e9b2a2 --- /dev/null +++ b/ext/spl/tests/bug69108.phpt @@ -0,0 +1,22 @@ +--TEST-- +Bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage) +--INI-- +zend.enable_gc=1 +--FILE-- +<?php +$a = array(); +$b = new SplObjectStorage(); +for ($i = 10000; $i > 0; $i--) { + $object = new StdClass(); + $a[] = $object; + $b->attach($object); +} + +$c = serialize(array($a, $b)); +$d = unserialize($c); + +unset($d); +echo "ok"; +?> +--EXPECT-- +ok |