Fixed bug #63055 (Segfault in zend_gc with SF2 testsuite)

NEWS

@@ -2,9 +2,13 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.3.19
 
-- mysql:
+- MySQL:
   . Fixed compilation failure on mixed 32/64 bit systems. (Andrey)
 
+- PCRE:
+  . Fixed bug #63055 (Segfault in zend_gc with SF2 testsuite).
+    (Dmitry, Laruence)
+
 - PDO:
   . Fixed bug #63235 (buffer overflow in use of SQLGetDiagRec).
     (Martin Osvald, Remi)

ext/pcre/php_pcre.c

@@ -547,8 +547,9 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 
 	/* Overwrite the passed-in value for subpatterns with an empty array. */
 	if (subpats != NULL) {
-		zval_dtor(subpats);
+		zval garbage = *subpats;
 		array_init(subpats);
+		zval_dtor(&garbage);
 	}
 
 	subpats_order = global ? PREG_PATTERN_ORDER : 0;

ext/pcre/tests/bug63055.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #63055 (Segfault in zend_gc with SF2 testsuite)
+--FILE--
+<?php
+/* the default gc root size is 10,000 */
+for ($i=0; $i<9998; $i++) {
+    $array = array();
+    $array[0] = &$array;
+    unset($array);
+}
+
+$matches = array("foo" => "bar"); /* this bucket will trigger the segfault */
+$dummy   = array("dummy");        /* used to trigger gc_collect_cycles */
+$dummy[1] = &$dummy;
+
+$matches[1] = &$matches;
+$matches[2] = $dummy;
+
+preg_match_all("/(\d)+/", "foo123456bar", $matches);
+echo "okey";
+?>
+--EXPECTF--
+okey