diff options
| author | Bob Weinand <bobwei9@hotmail.com> | 2015-07-05 02:00:38 +0200 |
|---|---|---|
| committer | Bob Weinand <bobwei9@hotmail.com> | 2015-07-05 02:00:52 +0200 |
| commit | 56b6e0dd14e376bc1131c5afb037419910daabf8 (patch) | |
| tree | cf6820a3946631798dab72546cf6500d96151c5a | |
| parent | 12b79fcb05dc264a9d0c50b52b31d41b21157e7d (diff) | |
| download | php-git-56b6e0dd14e376bc1131c5afb037419910daabf8.tar.gz | |
Fix use after free with opcache (interned strings)
| -rw-r--r-- | Zend/zend_compile.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index eb1a318ea5..2d41f3fda6 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -5074,7 +5074,8 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */ name = zend_new_interned_string(name); lcname = zend_new_interned_string(lcname); } else { - lcname = name = zend_generate_anon_class_name(decl->lex_pos); + name = zend_generate_anon_class_name(decl->lex_pos); + lcname = zend_string_copy(name); /* this normally is an interned string, except with opcache. We need a proper copy here or opcache will fail with use after free. */ } ce->type = ZEND_USER_CLASS; |