Fixed segfault in Zend/tests/008.phpt

bof · Feb 20, 2014 · cc15eb5 · cc15eb5
1 parent b917458
commit cc15eb5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/Zend/zend_gc.h b/Zend/zend_gc.h
@@ -140,6 +140,12 @@ END_EXTERN_C()
 		} \
 	} while (0)
 
+#define GC_REMOVE_ZOBJ_FROM_BUFFER(z) do { \
+		if (GC_ADDRESS((z)->gc.u.v.buffer)) { \
+			gc_remove_zval_from_buffer(&(z)->gc TSRMLS_CC); \
+		} \
+	} while (0)
+
 static zend_always_inline void gc_zval_check_possible_root(zval *z TSRMLS_DC)
 {
 	if (Z_TYPE_P(z) == IS_ARRAY || Z_TYPE_P(z) == IS_OBJECT) {

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
@@ -55,7 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS
 				obj->gc.refcount--;
 
 				if (obj->gc.refcount == 0) {
-					gc_remove_zval_from_buffer((zend_refcounted*)obj TSRMLS_CC);
+					GC_REMOVE_ZOBJ_FROM_BUFFER(obj TSRMLS_CC);
 				}
 			}
 		}
@@ -86,7 +86,7 @@ ZEND_API void zend_objects_store_free_object_storage(zend_objects_store *objects
 		zend_object *obj = objects->object_buckets[i];
 
 		if (IS_VALID(obj)) {
-			gc_remove_zval_from_buffer((zend_refcounted*)obj TSRMLS_CC);
+			GC_REMOVE_ZOBJ_FROM_BUFFER(obj TSRMLS_CC);
 			objects->object_buckets[i] = SET_INVALID(obj);
 			if (obj->handlers->free_obj) {
 				obj->handlers->free_obj(obj TSRMLS_CC);