[1.2.2] [CRASH] Fix segmentation fault in zend_std_write_property for PHP 5.4+

ext/config.c

@@ -77,14 +77,9 @@ typedef struct _phalcon_config_object {
  * @see phalcon_config_object
  * @param zobj @c \Phalcon\Config instance
  * @return phalcon_config_object associated with @a zobj
- * @pre <tt>Z_TYPE_P(zobj) == IS_OBJECT && instanceof_function(Z_OBJCE_P(zobj), phalcon_config_ce TSRMLS_CC)</tt>
  */
 static inline phalcon_config_object* fetchPhalconConfigObject(zval* zobj TSRMLS_DC)
 {
-#ifndef PHALCON_RELEASE
-	assert(Z_TYPE_P(zobj) == IS_OBJECT && instanceof_function(Z_OBJCE_P(zobj), phalcon_config_ce TSRMLS_CC));
-#endif
-
 	return (phalcon_config_object*)zend_objects_get_address(zobj TSRMLS_CC);
 }
 
@@ -266,14 +261,8 @@ static void phalcon_config_unset_dimension(zval *object, zval *offset TSRMLS_DC)
 static HashTable* phalcon_config_get_properties(zval* object TSRMLS_DC)
 {
 	HashTable* props = zend_std_get_properties(object TSRMLS_CC);
-
-	if (!GC_G(gc_active)) {
-		phalcon_config_object* obj = fetchPhalconConfigObject(object TSRMLS_CC);
-		zval *tmp;
-
-		zend_hash_copy(props, obj->props, (copy_ctor_func_t)zval_add_ref, (void*)&tmp, sizeof(zval*));
-	}
-
+	phalcon_config_object* obj = fetchPhalconConfigObject(object TSRMLS_CC);
+	zend_hash_copy(props, obj->props, (copy_ctor_func_t)zval_add_ref, NULL, sizeof(zval*));
 	return props;
 }
 
@@ -326,6 +315,9 @@ static zend_object_value phalcon_config_object_ctor(zend_class_entry* ce TSRMLS_
 	zend_object_value retval;
 
 	zend_object_std_init(&(obj->obj), ce TSRMLS_CC);
+	ALLOC_HASHTABLE(obj->props);
+	zend_hash_init(obj->props, 0, NULL, ZVAL_PTR_DTOR, 0);
+
 	retval.handle = zend_objects_store_put(
 		obj,
 		(zend_objects_store_dtor_t)zend_objects_destroy_object,
@@ -377,23 +369,16 @@ void phalcon_config_construct_internal(zval* this_ptr, zval *array_config TSRMLS
 	phalcon_config_object* obj;
 
 	if (!array_config || Z_TYPE_P(array_config) == IS_NULL) {
-		obj = fetchPhalconConfigObject(getThis() TSRMLS_CC);
-		ALLOC_HASHTABLE(obj->props);
-		zend_hash_init(obj->props, 0, NULL, ZVAL_PTR_DTOR, 0);
 		return;
 	}
 
 	phalcon_is_iterable(array_config, &ah0, &hp0, 0, 0);
 
 	obj = fetchPhalconConfigObject(getThis() TSRMLS_CC);
-	ALLOC_HASHTABLE(obj->props);
-	zend_hash_init(obj->props, zend_hash_num_elements(Z_ARRVAL_P(array_config)), NULL, ZVAL_PTR_DTOR, 0);
 
 	while (zend_hash_get_current_data_ex(ah0, (void**) &hd, &hp0) == SUCCESS) {
-
 		zval key = phalcon_get_current_key_w(ah0, &hp0);
 		phalcon_config_write_internal(obj, &key, *hd TSRMLS_CC);
-
 		zend_hash_move_forward_ex(ah0, &hp0);
 	}
 }
@@ -660,6 +645,16 @@ PHP_METHOD(Phalcon_Config, count)
 	RETURN_LONG(cnt);
 }
 
+PHP_METHOD(Phalcon_Config, __wakeup)
+{
+	HashTable *props;
+	phalcon_config_object *obj;
+
+	obj   = fetchPhalconConfigObject(getThis() TSRMLS_CC);
+	props = zend_std_get_properties(getThis() TSRMLS_CC);
+	zend_hash_copy(obj->props, props, (copy_ctor_func_t)zval_add_ref, NULL, sizeof(zval*));
+}
+
 /**
  * Restores the state of a Phalcon\Config object
  *

ext/pconfig.h

@@ -30,6 +30,7 @@ PHP_METHOD(Phalcon_Config, offsetUnset);
 PHP_METHOD(Phalcon_Config, merge);
 PHP_METHOD(Phalcon_Config, toArray);
 PHP_METHOD(Phalcon_Config, count);
+PHP_METHOD(Phalcon_Config, __wakeup);
 PHP_METHOD(Phalcon_Config, __set_state);
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_phalcon_config___construct, 0, 0, 0)
@@ -68,6 +69,9 @@ ZEND_END_ARG_INFO()
 ZEND_BEGIN_ARG_INFO_EX(arginfo_phalcon_config_count, 0, 0, 0)
 ZEND_END_ARG_INFO()
 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_phalcon_config___wakeup, 0, 0, 0)
+ZEND_END_ARG_INFO()
+
 ZEND_BEGIN_ARG_INFO_EX(arginfo_phalcon_config___set_state, 0, 0, 1)
 	ZEND_ARG_INFO(0, data)
 ZEND_END_ARG_INFO()
@@ -82,6 +86,7 @@ PHALCON_INIT_FUNCS(phalcon_config_method_entry){
 	PHP_ME(Phalcon_Config, merge, arginfo_phalcon_config_merge, ZEND_ACC_PUBLIC) 
 	PHP_ME(Phalcon_Config, toArray, arginfo_phalcon_config_toarray, ZEND_ACC_PUBLIC)
 	PHP_ME(Phalcon_Config, count, arginfo_phalcon_config_count, ZEND_ACC_PUBLIC)
+	PHP_ME(Phalcon_Config, __wakeup, arginfo_phalcon_config___wakeup, ZEND_ACC_PUBLIC)
 	PHP_ME(Phalcon_Config, __set_state, arginfo_phalcon_config___set_state, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 	PHP_MALIAS(Phalcon_Config, __get, offsetGet, arginfo_phalcon_config_offsetget, ZEND_ACC_PUBLIC)
 	PHP_MALIAS(Phalcon_Config, __set, offsetSet, arginfo_phalcon_config_offsetset, ZEND_ACC_PUBLIC)

unit-tests/ConfigTest.php

@@ -291,4 +291,12 @@ public function testConfigWithMergeAndGarbageCollection()
 		$config->merge(new Phalcon\Config(array('test2')));
 		gc_collect_cycles();
 	}
+
+	public function testIssue980()
+	{
+		$a = new Phalcon\Config(array('aaa' => array('b' => 2, 'c' => 3)));
+		$s = serialize($a);
+		$b = unserialize($s);
+		$this->assertEquals($a, $b);
+	}
 }