Fixed bug #54372 (Crash accessing global object itself returned from …

…its __get() handle) git-svn-id: http://svn.php.net/repository/php/php-src/php/php-src/branches/PHP_5_3@310009 c90b9560-bf6c-de11-be94-00142212c4b1
dsp · Apr 7, 2011 · 6c3845c · 6c3845c
1 parent 45a9e78
commit 6c3845c
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 - Zend Engine:
   . Fixed bug #54423 (classes from dl()'ed extensions are not destroyed). 
     (Tony, Dmitry)
+  . Fixed bug #54372 (Crash accessing global object itself returned from its
+    __get() handle). (Dmitry)
   . Fixed bug #54262 (Crash when assigning value to a dimension in a non-array).
     (Dmitry)
 

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
@@ -374,7 +374,11 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /*
 			} else {
 				retval = &EG(uninitialized_zval_ptr);
 			}
-			zval_ptr_dtor(&object);
+			if (EXPECTED(*retval != object)) {
+				zval_ptr_dtor(&object);
+			} else {
+				Z_DELREF_P(object);
+			}
 		} else {
 			if (zobj->ce->__get && guard && guard->in_get == 1) {
 				if (Z_STRVAL_P(member)[0] == '\0') {