summaryrefslogtreecommitdiffstats
path: root/php-pecl-memcache-3.0.7-get-mem-corrupt.patch
blob: 109d38e8a6286372dbec827295241845c1904448 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
--- pecl/memcache/branches/NON_BLOCKING_IO/memcache_pool.c	2012/09/23 07:13:18	327753
+++ pecl/memcache/branches/NON_BLOCKING_IO/memcache_pool.c	2012/09/23 08:29:10	327754
@@ -426,13 +426,15 @@
 {
 	char *data = NULL;
 	unsigned long data_len;
+	int rv;
 
-	zval value;
-	INIT_ZVAL(value);
+	zval *object;
+	ALLOC_INIT_ZVAL(object);
 
 	if (flags & MMC_COMPRESSED) {
 		if (mmc_uncompress(buffer->value.c, bytes, &data, &data_len) != MMC_OK) {
 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to uncompress data");
+			zval_ptr_dtor(&object);
 			return MMC_REQUEST_DONE;
 		}
 	}
@@ -444,7 +446,6 @@
 	if (flags & MMC_SERIALIZED) {
 		php_unserialize_data_t var_hash;
 		const unsigned char *p = (unsigned char *)data;
-		zval *object = &value;
 
 		char key_tmp[MMC_MAX_KEY_LEN + 1];
 		mmc_request_value_handler value_handler;
@@ -476,6 +477,7 @@
 			}
 
 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to unserialize data");
+			zval_ptr_dtor(&object);
 			return MMC_REQUEST_DONE;
 		}
 
@@ -492,7 +494,9 @@
 		}
 
 		/* delegate to value handler */
-		return value_handler(key_tmp, key_len, object, flags, cas, value_handler_param TSRMLS_CC);
+		rv = value_handler(key_tmp, key_len, object, flags, cas, value_handler_param TSRMLS_CC);
+		zval_ptr_dtor(&object);
+		return rv;
 	}
 	else {
 		switch (flags & 0x0f00) {
@@ -500,7 +504,7 @@
 				long val;
 				data[data_len] = '\0';
 				val = strtol(data, NULL, 10);
-				ZVAL_LONG(&value, val);
+				ZVAL_LONG(object, val);
 				break;
 			}
 
@@ -508,17 +512,17 @@
 				double val = 0;
 				data[data_len] = '\0';
 				sscanf(data, "%lg", &val);
-				ZVAL_DOUBLE(&value, val);
+				ZVAL_DOUBLE(object, val);
 				break;
 			}
 
 			case MMC_TYPE_BOOL:
-				ZVAL_BOOL(&value, data_len == 1 && data[0] == '1');
+				ZVAL_BOOL(object, data_len == 1 && data[0] == '1');
 				break;
 
 			default:
 				data[data_len] = '\0';
-				ZVAL_STRINGL(&value, data, data_len, 0);
+				ZVAL_STRINGL(object, data, data_len, 0);
 
 				if (!(flags & MMC_COMPRESSED)) {
 					/* release buffer because it's now owned by the zval */
@@ -527,7 +531,9 @@
 		}
 
 		/* delegate to value handler */
-		return request->value_handler(key, key_len, &value, flags, cas, request->value_handler_param TSRMLS_CC);
+		rv = request->value_handler(key, key_len, object, flags, cas, request->value_handler_param TSRMLS_CC);
+		zval_ptr_dtor(&object);
+		return rv;
 	}
 }
 /* }}}*/