Fixed use-after-free

dstogov · dstogov · commit ba8033feb0c2 · 2019-06-28T10:43:56.000+03:00
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
@@ -359,6 +359,7 @@ void shutdown_executor(void) /* {{{ */
 					if (ht) {
 						ZEND_ASSERT(GC_REFCOUNT(ht) == 1);
 						zend_array_destroy(ht);
+						ZEND_MAP_PTR_SET(op_array->static_variables_ptr, NULL);
 					}
 				}
 			} ZEND_HASH_FOREACH_END();
@@ -390,6 +391,7 @@ void shutdown_executor(void) /* {{{ */
 								if (ht) {
 									ZEND_ASSERT(GC_REFCOUNT(ht) == 1);
 									zend_array_destroy(ht);
+									ZEND_MAP_PTR_SET(op_array->static_variables_ptr, NULL);
 								}
 							}
 						}

Original file line number	Diff line number	Diff line change
`@@ -359,6 +359,7 @@ void shutdown_executor(void) /* {{{ */`
`359`	`359`	`if (ht) {`
`360`	`360`	`ZEND_ASSERT(GC_REFCOUNT(ht) == 1);`
`361`	`361`	`zend_array_destroy(ht);`
	`362`	`+ ZEND_MAP_PTR_SET(op_array->static_variables_ptr, NULL);`
`362`	`363`	`}`
`363`	`364`	`}`
`364`	`365`	`} ZEND_HASH_FOREACH_END();`
`@@ -390,6 +391,7 @@ void shutdown_executor(void) /* {{{ */`
`390`	`391`	`if (ht) {`
`391`	`392`	`ZEND_ASSERT(GC_REFCOUNT(ht) == 1);`
`392`	`393`	`zend_array_destroy(ht);`
	`394`	`+ ZEND_MAP_PTR_SET(op_array->static_variables_ptr, NULL);`
`393`	`395`	`}`
`394`	`396`	`}`
`395`	`397`	`}`