At 02:41 PM 10/27/2004 -0400, Ilia Alshanetsky wrote:
Oh?
The problem is that zendi effectively trashes the pointer to a temporary
zval created by tostring. The consequence is that the trashed zval is
leaked and when we try to free the zval we have another tmp zval this time
who's refcount in a random value, which explains the crash.
Ilia,
As I mentioned in my previous email (which you didn't answer), this doesn't
seem to be the right fix. If it is then half the engine is broken.
Please send me a very short reproducing script and I'll investigate and see
where the problem lies.
There is nothing wrong with reverting a patch when it requires more
investigation.
Andi
Ilia
Andi Gutmans wrote:
andi Wed Oct 27 14:15:03 2004 EDT
Modified files:
/ZendEngine2 zend_operators.c Log:
- Revert Fixed bug #30228 (crash when comparing SimpleXML attribute
to a boolean).
- Need to discuss where the real problem is.
http://cvs.php.net/diff.php/ZendEngine2/zend_operators.c?r1=1.199&r2=1.200&ty=u
Index: ZendEngine2/zend_operators.c
diff -u ZendEngine2/zend_operators.c:1.199 ZendEngine2/zend_operators.c:1.200
--- ZendEngine2/zend_operators.c:1.199 Tue Oct 26 18:38:34 2004
+++ ZendEngine2/zend_operators.c Wed Oct 27 14:15:03 2004
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_operators.c,v 1.199 2004/10/26 22:38:34 iliaa Exp $ */
+/* $Id: zend_operators.c,v 1.200 2004/10/27 18:15:03 andi Exp $ */
#include <ctype.h>
@@ -1323,11 +1323,7 @@
if (op1->type == IS_BOOL || op2->type == IS_BOOL
|| op1->type == IS_NULL || op2->type == IS_NULL) {
- if (free_op1) {
- convert_to_boolean(op1);
- } else {
- zendi_convert_to_boolean(op1, op1_copy, result);
- }
+ zendi_convert_to_boolean(op1, op1_copy, result);
zendi_convert_to_boolean(op2, op2_copy, result);
result->type = IS_LONG;
result->value.lval =
ZEND_NORMALIZE_BOOL(op1->value.lval-op2->value.lval);
--
Zend Engine CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--
Zend Engine CVS Mailing List (http://cvs.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
|
