Merge branch 'PHP-5.5' into PHP-5.6

dstogov · dstogov · commit 43e956a9a1b7 · 2014-07-30T10:40:06.000+04:00
* PHP-5.5:
  Fixed usage after free
diff --git a/ext/opcache/zend_accelerator_util_funcs.c b/ext/opcache/zend_accelerator_util_funcs.c
@@ -1041,7 +1041,6 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 		if (zend_hash_num_elements(&persistent_script->class_table) > 0) {
 			zend_accel_class_hash_copy(CG(class_table), &persistent_script->class_table, NULL TSRMLS_CC);
 		}
-		free_persistent_script(persistent_script, 0); /* free only hashes */
 	}
 
 #if ZEND_EXTENSION_API_NO >= PHP_5_3_X_API_NO
@@ -1053,6 +1052,10 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 	}
 #endif
 
+	if (!from_shared_memory) {
+		free_persistent_script(persistent_script, 0); /* free only hashes */
+	}
+
 	return op_array;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -1041,7 +1041,6 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,`
`1041`	`1041`	`if (zend_hash_num_elements(&persistent_script->class_table) > 0) {`
`1042`	`1042`	`zend_accel_class_hash_copy(CG(class_table), &persistent_script->class_table, NULL TSRMLS_CC);`
`1043`	`1043`	`}`
`1044`		`- free_persistent_script(persistent_script, 0); /* free only hashes */`
`1045`	`1044`	`}`
`1046`	`1045`
`1047`	`1046`	`#if ZEND_EXTENSION_API_NO >= PHP_5_3_X_API_NO`
`@@ -1053,6 +1052,10 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,`
`1053`	`1052`	`}`
`1054`	`1053`	`#endif`
`1055`	`1054`
	`1055`	`+ if (!from_shared_memory) {`
	`1056`	`+ free_persistent_script(persistent_script, 0); /* free only hashes */`
	`1057`	`+ }`
	`1058`	`+`
`1056`	`1059`	`return op_array;`
`1057`	`1060`	`}`
`1058`	`1061`