Patch bug63726.patch for Scripting Engine problem Bug #63726

Patch version 2012-12-10 11:30 UTC

Obsolete patches:

• bug63726.patch, revision 2012-12-09 13:07 UTC
• bug63726.patch, revision 2012-12-09 13:20 UTC

• 2012-12-10 11:30 UTC [diff to current]
• 2012-12-09 13:20 UTC [diff to current]
• 2012-12-09 13:07 UTC [diff to current]

Developer: laruence@php.net

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index c3d62c2..6dadd4d 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3708,6 +3708,8 @@ ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *na
 				(*property)->value = value->value;
 				if (Z_REFCOUNT_P(value) > 0) {
 					zval_copy_ctor(*property);
+				} else {
+					efree(value);
 				}
 			} else {
 				zval *garbage = *property;
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index f25e7fa..917e0c1 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3333,7 +3333,7 @@ static zend_bool do_inherit_property_access_check(HashTable *target_ht, zend_pro
 		if ((child_info->flags & ZEND_ACC_PPP_MASK) > (parent_info->flags & ZEND_ACC_PPP_MASK)) {
 			zend_error(E_COMPILE_ERROR, "Access level to %s::$%s must be %s (as in class %s)%s", ce->name, hash_key->arKey, zend_visibility_string(parent_info->flags), parent_ce->name, (parent_info->flags&ZEND_ACC_PUBLIC) ? "" : " or weaker");
 		} else if ((child_info->flags & ZEND_ACC_STATIC) == 0) {
-			Z_DELREF_P(ce->default_properties_table[parent_info->offset]);
+			zval_ptr_dtor(&(ce->default_properties_table[parent_info->offset]));
 			ce->default_properties_table[parent_info->offset] = ce->default_properties_table[child_info->offset];
 			ce->default_properties_table[child_info->offset] = NULL;
 			child_info->offset = parent_info->offset;
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index d82493a..3374b0b 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -539,6 +539,8 @@ ZEND_API void zend_std_write_property(zval *object, zval *member, zval *value, c
 				(*variable_ptr)->value = value->value;
 				if (Z_REFCOUNT_P(value) > 0) {
 					zval_copy_ctor(*variable_ptr);
+				} else {
+					efree(value);
 				}
 				zval_dtor(&garbage);
 			} else {