#45327 [NEW]: memory leak if offsetGet throws exception

From: cellog@php.net Operating system: linux 64bit PHP version: 5.2CVS-2008-06-21 (CVS) PHP Bug Type: Scripting Engine problem Bug description: memory leak if offsetGet throws exception Description: ------------ ext/phar's test phar_offset_get_error.phpt fails with leaked memory in zend_execute_API.c:1023, which is where retval is allocated. It turns out that if offsetGet() throws an exception, zend_std_read_dimension() does not free the return zval, and it leaks. This only affects PHP 5.2. The patch to fix is at http://pear.php.net/~greg/fix_leak.patch.txt and is pasted below Reproduce code: --------------- Index: Zend/zend_object_handlers.c =================================================================== RCS file: /repository/ZendEngine2/zend_object_handlers.c,v retrieving revision 1.135.2.6.2.28 diff -u -r1.135.2.6.2.28 zend_object_handlers.c --- Zend/zend_object_handlers.c 21 Feb 2008 13:55:22 -0000 1.135.2.6.2.28 +++ Zend/zend_object_handlers.c 21 Jun 2008 17:33:18 -0000 @@ -469,6 +469,10 @@ return 0; } + if (EG(exception)) { + zval_ptr_dtor(&retval); + return 0; + } /* Undo PZVAL_LOCK() */ retval->refcount--; -- Edit bug report at http://bugs.php.net/?id=45327&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=45327&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=45327&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=45327&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=45327&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=45327&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=45327&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=45327&r=needscript Try newer version: http://bugs.php.net/fix.php?id=45327&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=45327&r=support Expected behavior: http://bugs.php.net/fix.php?id=45327&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=45327&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=45327&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=45327&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=45327&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=45327&r=dst IIS Stability: http://bugs.php.net/fix.php?id=45327&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=45327&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=45327&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=45327&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=45327&r=mysqlcfg