diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-05-05 11:12:17 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-05-05 11:12:17 +0800 |
| commit | 1a5d58b28fe96e82836c627bc833499707ac4ec5 (patch) | |
| tree | 11052a812d46e51e4dde5d70f63cb99dc837a955 /ext/dba/dba.c | |
| parent | 9191862121411858036b0d2a06c3a99229c8bd24 (diff) | |
| download | php-git-1a5d58b28fe96e82836c627bc833499707ac4ec5.tar.gz | |
Fixed bug #72157 (use-after-free caused by dba_open)
Diffstat (limited to 'ext/dba/dba.c')
| -rw-r--r-- | ext/dba/dba.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/ext/dba/dba.c b/ext/dba/dba.c index e4776e734e..fd4522b9d6 100644 --- a/ext/dba/dba.c +++ b/ext/dba/dba.c @@ -658,11 +658,7 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, int persistent) /* we only take string arguments */ for (i = 0; i < ac; i++) { - if (Z_TYPE(args[i]) != IS_STRING) { - convert_to_string_ex(&args[i]); - } else if (Z_REFCOUNTED(args[i])) { - Z_ADDREF(args[i]); - } + ZVAL_STR(&args[i], zval_get_string(&args[i])); keylen += Z_STRLEN(args[i]); } |