diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | Zend/zend_object_handlers.c | 6 |
2 files changed, 7 insertions, 1 deletions
@@ -4,6 +4,8 @@ PHP NEWS - Zend Engine: . Fixed bug #54423 (classes from dl()'ed extensions are not destroyed). (Tony, Dmitry) + . Fixed bug #54372 (Crash accessing global object itself returned from its + __get() handle). (Dmitry) . Fixed bug #54262 (Crash when assigning value to a dimension in a non-array). (Dmitry) diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index ac373aeb6f..2fd097b662 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -374,7 +374,11 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /* } else { retval = &EG(uninitialized_zval_ptr); } - zval_ptr_dtor(&object); + if (EXPECTED(*retval != object)) { + zval_ptr_dtor(&object); + } else { + Z_DELREF_P(object); + } } else { if (zobj->ce->__get && guard && guard->in_get == 1) { if (Z_STRVAL_P(member)[0] == '\0') { |