Re: cvs: ZendEngine2 / zend_operators.c

Oh?

The problem is that zendi effectively trashes the pointer to a temporary 
zval created by tostring. The consequence is that the trashed zval is 
leaked and when we try to free the zval we have another tmp zval this 
time who's refcount in a random value, which explains the crash.
Ilia

Andi Gutmans wrote:
> andi            Wed Oct 27 14:15:03 2004 EDT
>
>   Modified files:              
>     /ZendEngine2	zend_operators.c 
>   Log:
>   - Revert   Fixed bug #30228 (crash when comparing SimpleXML attribute to a 
> boolean).
>   - Need to discuss where the real problem is.
>   
>   
> http://cvs.php.net/diff.php/ZendEngine2/zend_operators.c?r1=1.199&r2=1.200&ty=u
> Index: ZendEngine2/zend_operators.c
> diff -u ZendEngine2/zend_operators.c:1.199 ZendEngine2/zend_operators.c:1.200
> --- ZendEngine2/zend_operators.c:1.199  Tue Oct 26 18:38:34 2004
> +++ ZendEngine2/zend_operators.c        Wed Oct 27 14:15:03 2004
> @@ -17,7 +17,7 @@
>     +----------------------------------------------------------------------+
>  */
>  
> -/* $Id: zend_operators.c,v 1.199 2004/10/26 22:38:34 iliaa Exp $ */
> +/* $Id: zend_operators.c,v 1.200 2004/10/27 18:15:03 andi Exp $ */
>  
>  #include <ctype.h>
>  
> @@ -1323,11 +1323,7 @@
>         
>         if (op1->type == IS_BOOL || op2->type == IS_BOOL
>                 || op1->type == IS_NULL || op2->type == IS_NULL) {
> -               if (free_op1) {
> -                       convert_to_boolean(op1);
> -               } else {
> -                       zendi_convert_to_boolean(op1, op1_copy, result);
> -               }
> +               zendi_convert_to_boolean(op1, op1_copy, result);
>                 zendi_convert_to_boolean(op2, op2_copy, result);
>                 result->type = IS_LONG;
>                 result->value.lval = 
> ZEND_NORMALIZE_BOOL(op1->value.lval-op2->value.lval);
--
Zend Engine CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php