Fixed bug #61165 (Segfault - strip_tags())

php · Feb 25, 2012 · 1ee93c8 · 1ee93c8
1 parent bcefc31
commit 1ee93c8
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/NEWS b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? ??? 2012, PHP 5.3.11
 
 - Core:
+  . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
   . Improved max_input_vars directive to check nested variables (Dmitry).
   . Fixed bug #61095 (Incorect lexing of 0x00*+<NUM>). (Etienne)
   . Fixed bug #61072 (Memory leak when restoring an exception handler).

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
@@ -254,10 +254,15 @@ ZEND_API int zend_get_object_classname(const zval *object, char **class_name, ze
 static int parse_arg_object_to_string(zval **arg TSRMLS_DC) /* {{{ */
 {
 	if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
-		SEPARATE_ZVAL_IF_NOT_REF(arg);
-		if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, IS_STRING TSRMLS_CC) == SUCCESS) {
+		zval *obj;
+		ALLOC_ZVAL(obj);
+		MAKE_COPY_ZVAL(arg, obj);
+		if (Z_OBJ_HANDLER_P(*arg, cast_object)(*arg, obj, IS_STRING TSRMLS_CC) == SUCCESS) {
+			zval_ptr_dtor(arg);
+			*arg = obj;
 			return SUCCESS;
 		}
+		zval_ptr_dtor(&obj);
 	}
 	/* Standard PHP objects */
 	if (Z_OBJ_HT_PP(arg) == &std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) {