Partial fix for bug #68365 (zend_mm_heap corrupted after memory overflow in zend_hash_copy)

dstogov · dstogov · commit 9dfa843a386b · 2014-11-07T09:46:49.000+03:00
diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c
@@ -135,9 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				}
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
+				zvalue->value.ht = tmp_ht;
 				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
-				zvalue->value.ht = tmp_ht;
 			}
 			break;
 		case IS_OBJECT:

Original file line number	Diff line number	Diff line change
`@@ -135,9 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)`
`135`	`135`	`}`
`136`	`136`	`ALLOC_HASHTABLE_REL(tmp_ht);`
`137`	`137`	`zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);`
	`138`	`+ zvalue->value.ht = tmp_ht;`
`138`	`139`	`zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void ) &tmp, sizeof(zval ));`
`139`	`140`	`tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;`
`140`		`- zvalue->value.ht = tmp_ht;`
`141`	`141`	`}`
`142`	`142`	`break;`
`143`	`143`	`case IS_OBJECT:`