- Fixed bug #50145 (crash while running bug35634.phpt)

NEWS

@@ -23,6 +23,7 @@ PHP                                                                        NEWS
 - Fixed bug #50174 (Incorrectly matched docComment). (Felipe)
 - Fixed bug #50158 (FILTER_VALIDATE_EMAIL fails with valid addresses
   containing = or ?). (Pierrick)
+- Fixed bug #50145 (crash while running bug35634.phpt). (Felipe)
 - Fixed bug #50087 (NSAPI performance improvements). (Uwe Schindler)
 - Fixed bug #50152 (ReflectionClass::hasProperty behaves like isset() not
   property_exists). (Felipe)

Zend/zend_language_scanner.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Thu Sep 10 15:34:33 2009 */
+/* Generated by re2c 0.13.5 on Mon Nov 16 23:30:01 2009 */
 #line 1 "Zend/zend_language_scanner.l"
 /*
    +----------------------------------------------------------------------+
@@ -685,12 +685,12 @@ ZEND_API int zend_multibyte_read_script(unsigned char *buf, size_t n TSRMLS_DC)
 {
 	if (SCNG(script_org)) {
 		efree(SCNG(script_org));
+		SCNG(script_org) = NULL;
 	}
-	SCNG(script_org_size) = n;
-	SCNG(script_org) = (unsigned char*)erealloc(SCNG(script_org), SCNG(script_org_size));
-	memcpy(SCNG(script_org) + SCNG(script_org_size) - n, buf, n);
+	SCNG(script_org_size) = n;	
 	
-	SCNG(script_org) = (unsigned char*)erealloc(SCNG(script_org), SCNG(script_org_size) + 1);
+	SCNG(script_org) = (unsigned char*)emalloc(SCNG(script_org_size) + 1);
+	memcpy(SCNG(script_org), buf, n);
 	*(SCNG(script_org)+SCNG(script_org_size)) = '\0';
 
 	return 0;

Zend/zend_language_scanner.l

@@ -683,12 +683,12 @@ ZEND_API int zend_multibyte_read_script(unsigned char *buf, size_t n TSRMLS_DC)
 {
 	if (SCNG(script_org)) {
 		efree(SCNG(script_org));
+		SCNG(script_org) = NULL;
 	}
-	SCNG(script_org_size) = n;
-	SCNG(script_org) = (unsigned char*)erealloc(SCNG(script_org), SCNG(script_org_size));
-	memcpy(SCNG(script_org) + SCNG(script_org_size) - n, buf, n);
+	SCNG(script_org_size) = n;	
 	
-	SCNG(script_org) = (unsigned char*)erealloc(SCNG(script_org), SCNG(script_org_size) + 1);
+	SCNG(script_org) = (unsigned char*)emalloc(SCNG(script_org_size) + 1);
+	memcpy(SCNG(script_org), buf, n);
 	*(SCNG(script_org)+SCNG(script_org_size)) = '\0';
 
 	return 0;