Fixed usage after free

dstogov · dstogov · commit aa3ddda8e504 · 2014-07-30T10:39:25.000+04:00
diff --git a/ext/opcache/zend_accelerator_util_funcs.c b/ext/opcache/zend_accelerator_util_funcs.c
@@ -979,7 +979,6 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 		if (zend_hash_num_elements(&persistent_script->class_table) > 0) {
 			zend_accel_class_hash_copy(CG(class_table), &persistent_script->class_table, NULL TSRMLS_CC);
 		}
-		free_persistent_script(persistent_script, 0); /* free only hashes */
 	}
 
 #if ZEND_EXTENSION_API_NO >= PHP_5_3_X_API_NO
@@ -991,6 +990,10 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 	}
 #endif
 
+	if (!from_shared_memory) {
+		free_persistent_script(persistent_script, 0); /* free only hashes */
+	}
+
 	return op_array;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -979,7 +979,6 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,`
`979`	`979`	`if (zend_hash_num_elements(&persistent_script->class_table) > 0) {`
`980`	`980`	`zend_accel_class_hash_copy(CG(class_table), &persistent_script->class_table, NULL TSRMLS_CC);`
`981`	`981`	`}`
`982`		`- free_persistent_script(persistent_script, 0); /* free only hashes */`
`983`	`982`	`}`
`984`	`983`
`985`	`984`	`#if ZEND_EXTENSION_API_NO >= PHP_5_3_X_API_NO`
`@@ -991,6 +990,10 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,`
`991`	`990`	`}`
`992`	`991`	`#endif`
`993`	`992`
	`993`	`+ if (!from_shared_memory) {`
	`994`	`+ free_persistent_script(persistent_script, 0); /* free only hashes */`
	`995`	`+ }`
	`996`	`+`
`994`	`997`	`return op_array;`
`995`	`998`	`}`
`996`	`999`