diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2014-11-07 09:46:49 +0300 |
|---|---|---|
| committer | Ferenc Kovacs <tyrael@php.net> | 2014-11-12 02:06:30 +0100 |
| commit | 6e9144de5a3b60af92df8aa9076675c5a9611547 (patch) | |
| tree | eabc761e1dc403a75d69ab0e7c30b32da0403433 | |
| parent | 01b665ee7e1a16ca112eb881b3f34b4f49e9d7fe (diff) | |
| download | php-git-6e9144de5a3b60af92df8aa9076675c5a9611547.tar.gz | |
Partial fix for bug #68365 (zend_mm_heap corrupted after memory overflow in zend_hash_copy)
| -rw-r--r-- | Zend/zend_variables.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c index 8a41902a97..75230babda 100644 --- a/Zend/zend_variables.c +++ b/Zend/zend_variables.c @@ -137,9 +137,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC) } ALLOC_HASHTABLE_REL(tmp_ht); zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0); + zvalue->value.ht = tmp_ht; zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *)); tmp_ht->nNextFreeElement = original_ht->nNextFreeElement; - zvalue->value.ht = tmp_ht; } break; case IS_CONSTANT_AST: |