diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 5 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 20 | ||||
| -rw-r--r-- | ext/gd/libgd/gdft.c | 6 | ||||
| -rw-r--r-- | ext/session/session.c | 7 |
5 files changed, 31 insertions, 10 deletions
@@ -25,4 +25,7 @@ PHP NEWS - XSL: . Fixed bug #64776 (The XSLT extension is not thread safe). (Mike) +- GD: + . Made fontFetch's path parser thread-safe. (Sara) + <<< NOTE: Insert NEWS from last stable release here prior to actual release! >>> diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index be01accf6a..9186b96c82 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -4547,7 +4547,10 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY) ZVAL_UNREF(array_ref); array_ptr = array_ref; } - if (Z_IMMUTABLE_P(array_ptr)) { + if (Z_IMMUTABLE_P(array_ptr) || + (Z_ISREF_P(array_ref) && + Z_REFCOUNTED_P(array_ptr) && + Z_REFCOUNT_P(array_ptr) > 1)) { zval_copy_ctor(array_ptr); } Z_ADDREF_P(array_ref); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 9bc2c13c30..430f10ba00 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -3161,7 +3161,10 @@ static int ZEND_FASTCALL ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A ZVAL_UNREF(array_ref); array_ptr = array_ref; } - if (Z_IMMUTABLE_P(array_ptr)) { + if (Z_IMMUTABLE_P(array_ptr) || + (Z_ISREF_P(array_ref) && + Z_REFCOUNTED_P(array_ptr) && + Z_REFCOUNT_P(array_ptr) > 1)) { zval_copy_ctor(array_ptr); } Z_ADDREF_P(array_ref); @@ -8678,7 +8681,10 @@ static int ZEND_FASTCALL ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG ZVAL_UNREF(array_ref); array_ptr = array_ref; } - if (Z_IMMUTABLE_P(array_ptr)) { + if (Z_IMMUTABLE_P(array_ptr) || + (Z_ISREF_P(array_ref) && + Z_REFCOUNTED_P(array_ptr) && + Z_REFCOUNT_P(array_ptr) > 1)) { zval_copy_ctor(array_ptr); } Z_ADDREF_P(array_ref); @@ -14118,7 +14124,10 @@ static int ZEND_FASTCALL ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG ZVAL_UNREF(array_ref); array_ptr = array_ref; } - if (Z_IMMUTABLE_P(array_ptr)) { + if (Z_IMMUTABLE_P(array_ptr) || + (Z_ISREF_P(array_ref) && + Z_REFCOUNTED_P(array_ptr) && + Z_REFCOUNT_P(array_ptr) > 1)) { zval_copy_ctor(array_ptr); } Z_ADDREF_P(array_ref); @@ -31476,7 +31485,10 @@ static int ZEND_FASTCALL ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS ZVAL_UNREF(array_ref); array_ptr = array_ref; } - if (Z_IMMUTABLE_P(array_ptr)) { + if (Z_IMMUTABLE_P(array_ptr) || + (Z_ISREF_P(array_ref) && + Z_REFCOUNTED_P(array_ptr) && + Z_REFCOUNT_P(array_ptr) > 1)) { zval_copy_ctor(array_ptr); } Z_ADDREF_P(array_ref); diff --git a/ext/gd/libgd/gdft.c b/ext/gd/libgd/gdft.c index 4979e1511f..4148cf47bb 100644 --- a/ext/gd/libgd/gdft.c +++ b/ext/gd/libgd/gdft.c @@ -390,9 +390,10 @@ static void *fontFetch (char **error, void *key) fontlist = gdEstrdup(a->fontlist); /* - * Must use gd_strtok_r else pointer corrupted by strtok in nested loop. + * Must use gd_strtok_r becasuse strtok() isn't thread safe */ for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name; name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) { + char *strtok_ptr_path; /* make a fresh copy each time - strtok corrupts it. */ path = gdEstrdup (fontsearchpath); @@ -408,7 +409,8 @@ static void *fontFetch (char **error, void *key) break; } } - for (dir = strtok (path, PATHSEPARATOR); dir; dir = strtok (0, PATHSEPARATOR)) { + for (dir = gd_strtok_r (path, PATHSEPARATOR, &strtok_ptr_path); dir; + dir = gd_strtok_r (0, PATHSEPARATOR, &strtok_ptr_path)) { if (!strcmp(dir, ".")) { TSRMLS_FETCH(); #if HAVE_GETCWD diff --git a/ext/session/session.c b/ext/session/session.c index a7b79c2300..8811a08caf 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -1266,12 +1266,13 @@ static void php_session_remove_cookie(TSRMLS_D) { zend_llist *l = &SG(sapi_headers).headers; zend_llist_element *next; zend_llist_element *current; - char *session_cookie, *e_session_name; + char *session_cookie; + zend_string *e_session_name; int session_cookie_len, len = sizeof("Set-Cookie")-1; e_session_name = php_url_encode(PS(session_name), strlen(PS(session_name))); - spprintf(&session_cookie, 0, "Set-Cookie: %s=", e_session_name); - efree(e_session_name); + spprintf(&session_cookie, 0, "Set-Cookie: %s=", e_session_name->val); + STR_FREE(e_session_name); session_cookie_len = strlen(session_cookie); current = l->head; |