summaryrefslogtreecommitdiffstats
path: root/php-pecl-memcache-3.0.5-get-mem-corrupt.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2012-09-23 10:42:18 +0200
committerRemi Collet <fedora@famillecollet.com>2012-09-23 10:42:18 +0200
commit679c2ac2fac97dbd539b420ed3a4be58f796ee5d (patch)
tree2050acb9d713213e0a6d5c0a1d979380cb19ee10 /php-pecl-memcache-3.0.5-get-mem-corrupt.patch
parent654d2ec6d3e0a7b515ef7a4b7aa5b3557b877523 (diff)
php-pecl-memcache: upstream patch
Diffstat (limited to 'php-pecl-memcache-3.0.5-get-mem-corrupt.patch')
-rw-r--r--php-pecl-memcache-3.0.5-get-mem-corrupt.patch89
1 files changed, 0 insertions, 89 deletions
diff --git a/php-pecl-memcache-3.0.5-get-mem-corrupt.patch b/php-pecl-memcache-3.0.5-get-mem-corrupt.patch
deleted file mode 100644
index 0b7c66c..0000000
--- a/php-pecl-memcache-3.0.5-get-mem-corrupt.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From 6e09e8db8d36de6a5020f5d517f62a8c16af8222 Mon Sep 17 00:00:00 2001
-From: "Vojtech Vitek (V-Teq)" <vvitek@redhat.com>
-Date: Mon, 17 Oct 2011 16:17:51 +0200
-Subject: [PATCH] fix get/unserialize memory corruption
-
-Possible memory corruption (and segfault) after unserialising objects:
-<?php
-$obj = new StdClass;
-$obj->obj = $obj;
-$memcache = new Memcache;
-$memcache->connect('127.0.0.1', 11211);
-$memcache->set('x', $obj, false, 300);
-$x = $memcache->get('x');
-$x = $memcache->get('x');
-$x = $memcache->get('x');
-$x = $memcache->get('x');
-$x = $memcache->get('x');
-
-Patch by Paul Clifford.
-
----
- memcache-3.0.5/memcache_pool.c | 15 +++++++--------
- 1 files changed, 7 insertions(+), 8 deletions(-)
-
-diff --git memcache-3.0.5/memcache_pool.c memcache-3.0.5/memcache_pool.c
-index 420a773..e89ebce 100644
---- memcache-3.0.5/memcache_pool.c
-+++ memcache-3.0.5/memcache_pool.c
-@@ -422,8 +422,8 @@ int mmc_unpack_value(
- char *data = NULL;
- unsigned long data_len;
-
-- zval value;
-- INIT_ZVAL(value);
-+ zval *object;
-+ ALLOC_INIT_ZVAL(object);
-
- if (flags & MMC_COMPRESSED) {
- if (mmc_uncompress(buffer->value.c, bytes, &data, &data_len) != MMC_OK) {
-@@ -439,7 +439,6 @@ int mmc_unpack_value(
- if (flags & MMC_SERIALIZED) {
- php_unserialize_data_t var_hash;
- const unsigned char *p = (unsigned char *)data;
-- zval *object = &value;
-
- char key_tmp[MMC_MAX_KEY_LEN + 1];
- mmc_request_value_handler value_handler;
-@@ -495,7 +494,7 @@ int mmc_unpack_value(
- long val;
- data[data_len] = '\0';
- val = strtol(data, NULL, 10);
-- ZVAL_LONG(&value, val);
-+ ZVAL_LONG(object, val);
- break;
- }
-
-@@ -503,17 +502,17 @@ int mmc_unpack_value(
- double val = 0;
- data[data_len] = '\0';
- sscanf(data, "%lg", &val);
-- ZVAL_DOUBLE(&value, val);
-+ ZVAL_DOUBLE(object, val);
- break;
- }
-
- case MMC_TYPE_BOOL:
-- ZVAL_BOOL(&value, data_len == 1 && data[0] == '1');
-+ ZVAL_BOOL(object, data_len == 1 && data[0] == '1');
- break;
-
- default:
- data[data_len] = '\0';
-- ZVAL_STRINGL(&value, data, data_len, 0);
-+ ZVAL_STRINGL(object, data, data_len, 0);
-
- if (!(flags & MMC_COMPRESSED)) {
- /* release buffer because it's now owned by the zval */
-@@ -522,7 +521,7 @@ int mmc_unpack_value(
- }
-
- /* delegate to value handler */
-- return request->value_handler(key, key_len, &value, flags, cas, request->value_handler_param TSRMLS_CC);
-+ return request->value_handler(key, key_len, object, flags, cas, request->value_handler_param TSRMLS_CC);
- }
- }
- /* }}}*/
---
-1.7.6.2
-