Commits

Ruslan Osmanov committed aceaf22

Dev: fixing possible memory access violations in EventBufferEvent input/output property handlers

  • Participants
  • Parent commits 02818c6

Comments (0)

Files changed (1)

 		return FAILURE;
 	}
 
-	MAKE_STD_ZVAL(*retval);
-
-	/* XXX Is it safe to cache it here? */
-	if (bev->input) {
-		ZVAL_ZVAL(*retval, bev->input, 1, 0);
-		return SUCCESS;
-	}
+	if (!bev->input) {
+		php_event_buffer_t *b;
 
-	php_event_buffer_t *b;
+		MAKE_STD_ZVAL(bev->input);
+		PHP_EVENT_INIT_CLASS_OBJECT(bev->input, php_event_buffer_ce);
+		PHP_EVENT_FETCH_BUFFER(b, bev->input);
 
-	PHP_EVENT_INIT_CLASS_OBJECT(*retval, php_event_buffer_ce);
-	PHP_EVENT_FETCH_BUFFER(b, *retval);
-
-	b->buf      = bufferevent_get_input(bev->bevent);
-	b->internal = 1;
+		b->buf      = bufferevent_get_input(bev->bevent);
+		b->internal = 1;
+	}
 
-	MAKE_STD_ZVAL(bev->input);
-	ZVAL_ZVAL(bev->input, *retval, 1, 0);
-	Z_ADDREF_P(bev->input);
+	MAKE_STD_ZVAL(*retval);
 
+	ZVAL_ZVAL(*retval, bev->input, 1, 0);
+	Z_SET_ISREF_P(*retval);
+	Z_ADDREF_P(*retval);
 	return SUCCESS;
 }
 /* }}} */
 		return FAILURE;
 	}
 
-	MAKE_STD_ZVAL(*retval);
-
-	/* XXX Is it safe to cache it here? */
-	if (bev->output) {
-		ZVAL_ZVAL(*retval, bev->output, 1, 0);
-		Z_ADDREF_P(bev->output);
-		return SUCCESS;
-	}
+	if (!bev->output) {
+		php_event_buffer_t *b;
 
-	php_event_buffer_t *b;
+		MAKE_STD_ZVAL(bev->output);
+		PHP_EVENT_INIT_CLASS_OBJECT(bev->output, php_event_buffer_ce);
+		PHP_EVENT_FETCH_BUFFER(b, bev->output);
 
-	PHP_EVENT_INIT_CLASS_OBJECT(*retval, php_event_buffer_ce);
-	PHP_EVENT_FETCH_BUFFER(b, *retval);
-
-	b->buf      = bufferevent_get_output(bev->bevent);
-	b->internal = 1;
+		b->buf      = bufferevent_get_output(bev->bevent);
+		b->internal = 1;
+	}
 
-	MAKE_STD_ZVAL(bev->output);
-	ZVAL_ZVAL(bev->output, *retval, 1, 0);
-	Z_ADDREF_P(bev->output);
+	MAKE_STD_ZVAL(*retval);
 
+	ZVAL_ZVAL(*retval, bev->output, 1, 0);
+	Z_SET_ISREF_P(*retval);
+	Z_ADDREF_P(*retval);
 	return SUCCESS;
 }
 /* }}} */