From 679c2ac2fac97dbd539b420ed3a4be58f796ee5d Mon Sep 17 00:00:00 2001
From: Remi Collet <fedora@famillecollet.com>
Date: Sun, 23 Sep 2012 10:42:18 +0200
Subject: php-pecl-memcache: upstream patch

---
 php-pecl-memcache-3.0.7-get-mem-corrupt.patch | 88 +++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)
 create mode 100644 php-pecl-memcache-3.0.7-get-mem-corrupt.patch

(limited to 'php-pecl-memcache-3.0.7-get-mem-corrupt.patch')

diff --git a/php-pecl-memcache-3.0.7-get-mem-corrupt.patch b/php-pecl-memcache-3.0.7-get-mem-corrupt.patch
new file mode 100644
index 0000000..109d38e
--- /dev/null
+++ b/php-pecl-memcache-3.0.7-get-mem-corrupt.patch
@@ -0,0 +1,88 @@
+--- pecl/memcache/branches/NON_BLOCKING_IO/memcache_pool.c	2012/09/23 07:13:18	327753
++++ pecl/memcache/branches/NON_BLOCKING_IO/memcache_pool.c	2012/09/23 08:29:10	327754
+@@ -426,13 +426,15 @@
+ {
+ 	char *data = NULL;
+ 	unsigned long data_len;
++	int rv;
+ 
+-	zval value;
+-	INIT_ZVAL(value);
++	zval *object;
++	ALLOC_INIT_ZVAL(object);
+ 
+ 	if (flags & MMC_COMPRESSED) {
+ 		if (mmc_uncompress(buffer->value.c, bytes, &data, &data_len) != MMC_OK) {
+ 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to uncompress data");
++			zval_ptr_dtor(&object);
+ 			return MMC_REQUEST_DONE;
+ 		}
+ 	}
+@@ -444,7 +446,6 @@
+ 	if (flags & MMC_SERIALIZED) {
+ 		php_unserialize_data_t var_hash;
+ 		const unsigned char *p = (unsigned char *)data;
+-		zval *object = &value;
+ 
+ 		char key_tmp[MMC_MAX_KEY_LEN + 1];
+ 		mmc_request_value_handler value_handler;
+@@ -476,6 +477,7 @@
+ 			}
+ 
+ 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to unserialize data");
++			zval_ptr_dtor(&object);
+ 			return MMC_REQUEST_DONE;
+ 		}
+ 
+@@ -492,7 +494,9 @@
+ 		}
+ 
+ 		/* delegate to value handler */
+-		return value_handler(key_tmp, key_len, object, flags, cas, value_handler_param TSRMLS_CC);
++		rv = value_handler(key_tmp, key_len, object, flags, cas, value_handler_param TSRMLS_CC);
++		zval_ptr_dtor(&object);
++		return rv;
+ 	}
+ 	else {
+ 		switch (flags & 0x0f00) {
+@@ -500,7 +504,7 @@
+ 				long val;
+ 				data[data_len] = '\0';
+ 				val = strtol(data, NULL, 10);
+-				ZVAL_LONG(&value, val);
++				ZVAL_LONG(object, val);
+ 				break;
+ 			}
+ 
+@@ -508,17 +512,17 @@
+ 				double val = 0;
+ 				data[data_len] = '\0';
+ 				sscanf(data, "%lg", &val);
+-				ZVAL_DOUBLE(&value, val);
++				ZVAL_DOUBLE(object, val);
+ 				break;
+ 			}
+ 
+ 			case MMC_TYPE_BOOL:
+-				ZVAL_BOOL(&value, data_len == 1 && data[0] == '1');
++				ZVAL_BOOL(object, data_len == 1 && data[0] == '1');
+ 				break;
+ 
+ 			default:
+ 				data[data_len] = '\0';
+-				ZVAL_STRINGL(&value, data, data_len, 0);
++				ZVAL_STRINGL(object, data, data_len, 0);
+ 
+ 				if (!(flags & MMC_COMPRESSED)) {
+ 					/* release buffer because it's now owned by the zval */
+@@ -527,7 +531,9 @@
+ 		}
+ 
+ 		/* delegate to value handler */
+-		return request->value_handler(key, key_len, &value, flags, cas, request->value_handler_param TSRMLS_CC);
++		rv = request->value_handler(key, key_len, object, flags, cas, request->value_handler_param TSRMLS_CC);
++		zval_ptr_dtor(&object);
++		return rv;
+ 	}
+ }
+ /* }}}*/
-- 
cgit