Check hash protection flag to avoid memory corruption

rlerdorf · rlerdorf · commit 56d96c597085 · 2016-02-29T06:56:40.000-08:00
diff --git a/msgpack_pack.c b/msgpack_pack.c
@@ -283,11 +283,11 @@ static inline void msgpack_serialize_array(smart_str *buf, zval *val, HashTable
 				if ((Z_TYPE_P(value_noref) == IS_ARRAY && ZEND_HASH_GET_APPLY_COUNT(Z_ARRVAL_P(value_noref)) > 1)) {
 					msgpack_pack_nil(buf);
 				} else {
-					if (Z_TYPE_P(value_noref) == IS_ARRAY) {
+					if (Z_TYPE_P(value_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(value_noref))) {
 						ZEND_HASH_INC_APPLY_COUNT(Z_ARRVAL_P(value_noref));
 					}
 					msgpack_serialize_zval(buf, value, var_hash);
-					if (Z_TYPE_P(value_noref) == IS_ARRAY) {
+					if (Z_TYPE_P(value_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(value_noref))) {
 						ZEND_HASH_DEC_APPLY_COUNT(Z_ARRVAL_P(value_noref));
 					}
 				}
@@ -310,13 +310,13 @@ static inline void msgpack_serialize_array(smart_str *buf, zval *val, HashTable
 						data_noref = data;
 					}
 
-					if (Z_TYPE_P(data_noref) == IS_ARRAY) {
+					if (Z_TYPE_P(data_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(data_noref))) {
 						ZEND_HASH_INC_APPLY_COUNT(Z_ARRVAL_P(data_noref));
 					}
 
 					msgpack_serialize_zval(buf, data, var_hash);
 
-					if (Z_TYPE_P(data_noref) == IS_ARRAY) {
+					if (Z_TYPE_P(data_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(data_noref))) {
 						ZEND_HASH_DEC_APPLY_COUNT(Z_ARRVAL_P(data_noref));
 					}
 				}

Original file line number	Diff line number	Diff line change
`@@ -283,11 +283,11 @@ static inline void msgpack_serialize_array(smart_str buf, zval val, HashTable`
`283`	`283`	`if ((Z_TYPE_P(value_noref) == IS_ARRAY && ZEND_HASH_GET_APPLY_COUNT(Z_ARRVAL_P(value_noref)) > 1)) {`
`284`	`284`	`msgpack_pack_nil(buf);`
`285`	`285`	`} else {`
`286`		`- if (Z_TYPE_P(value_noref) == IS_ARRAY) {`
	`286`	`+ if (Z_TYPE_P(value_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(value_noref))) {`
`287`	`287`	`ZEND_HASH_INC_APPLY_COUNT(Z_ARRVAL_P(value_noref));`
`288`	`288`	`}`
`289`	`289`	`msgpack_serialize_zval(buf, value, var_hash);`
`290`		`- if (Z_TYPE_P(value_noref) == IS_ARRAY) {`
	`290`	`+ if (Z_TYPE_P(value_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(value_noref))) {`
`291`	`291`	`ZEND_HASH_DEC_APPLY_COUNT(Z_ARRVAL_P(value_noref));`
`292`	`292`	`}`
`293`	`293`	`}`
`@@ -310,13 +310,13 @@ static inline void msgpack_serialize_array(smart_str buf, zval val, HashTable`
`310`	`310`	`data_noref = data;`
`311`	`311`	`}`
`312`	`312`
`313`		`- if (Z_TYPE_P(data_noref) == IS_ARRAY) {`
	`313`	`+ if (Z_TYPE_P(data_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(data_noref))) {`
`314`	`314`	`ZEND_HASH_INC_APPLY_COUNT(Z_ARRVAL_P(data_noref));`
`315`	`315`	`}`
`316`	`316`
`317`	`317`	`msgpack_serialize_zval(buf, data, var_hash);`
`318`	`318`
`319`		`- if (Z_TYPE_P(data_noref) == IS_ARRAY) {`
	`319`	`+ if (Z_TYPE_P(data_noref) == IS_ARRAY && ZEND_HASH_APPLY_PROTECTION(Z_ARRVAL_P(data_noref))) {`
`320`	`320`	`ZEND_HASH_DEC_APPLY_COUNT(Z_ARRVAL_P(data_noref));`
`321`	`321`	`}`
`322`	`322`	`}`