mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #54268 (Double free when destroy_zend_class fails)

Browse Source
This commit is contained in:
Dmitry Stogov 2011-04-15 12:43:20 +00:00
parent 8fe3ea75cb
commit 50ce16deff
3 changed files with 47 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
Zend/tests/bug54268.phpt Normal file
View File

@ -0,0 +1,35 @@
--TEST--
Bug #54268 (Double free when destroy_zend_class fails)
--INI--
memory_limit=8M
--SKIPIF--
<?php
$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
if ($zend_mm_enabled === "0") {
die("skip Zend MM disabled");
}
?>
--FILE--
<?php
class DestructableObject
{
public function __destruct()
{
DestructableObject::__destruct();
}
}
class DestructorCreator
{
public function __destruct()
{
$this->test = new DestructableObject;
}
}
class Test
{
public static $mystatic;
}
$x = new Test();
Test::$mystatic = new DestructorCreator();
--EXPECTF--
Fatal error: Allowed memory size of %s bytes exhausted%s(tried to allocate %s bytes) in %s on line %d

2
Zend/zend_execute_API.c
View File

@ -289,7 +289,9 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
zend_hash_reverse_apply(EG(class_table), (apply_func_t) zend_cleanup_user_class_data TSRMLS_CC);
zend_cleanup_internal_classes(TSRMLS_C);
}
} zend_end_try();
zend_try {
zend_vm_stack_destroy(TSRMLS_C);
zend_objects_store_free_object_storage(&EG(objects_store) TSRMLS_CC);

22
Zend/zend_hash.c
View File

@ -563,9 +563,17 @@ ZEND_API void zend_hash_clean(HashTable *ht)
IS_CONSISTENT(ht);
SET_INCONSISTENT(HT_CLEANING);
p = ht->pListHead;
if (ht->nTableMask) {
memset(ht->arBuckets, 0, ht->nTableSize*sizeof(Bucket *));
}
ht->pListHead = NULL;
ht->pListTail = NULL;
ht->nNumOfElements = 0;
ht->nNextFreeElement = 0;
ht->pInternalPointer = NULL;
while (p != NULL) {
q = p;
p = p->pListNext;
@ -577,16 +585,6 @@ ZEND_API void zend_hash_clean(HashTable *ht)
}
pefree(q, ht->persistent);
}
if (ht->nTableMask) {
memset(ht->arBuckets, 0, ht->nTableSize*sizeof(Bucket *));
}
ht->pListHead = NULL;
ht->pListTail = NULL;
ht->nNumOfElements = 0;
ht->nNextFreeElement = 0;
ht->pInternalPointer = NULL;
SET_INCONSISTENT(HT_OK);
}
/* This function is used by the various apply() functions.