com php-src: Fixed bug #67856 (Leak when using array_reduce with by-ref function): Zend/tests/bug6785 6.phpt ext/standard/array.c

Commit: 0f5bad93fd9eb0bb73855b536d15c6b6bacb6dbc Author: Dmitry Stogov <dmitry@zend.com> Mon, 18 Aug 2014 21:08:50 +0400 Parents: 29a87013892d1646b8e2ee79f1a89f3de2be5ad7 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=0f5bad93fd9eb0bb73855b536d15c6b6bacb6dbc Log: Fixed bug #67856 (Leak when using array_reduce with by-ref function) Bugs: https://bugs.php.net/67856 Changed paths: A Zend/tests/bug67856.phpt M ext/standard/array.c Diff: diff --git a/Zend/tests/bug67856.phpt b/Zend/tests/bug67856.phpt new file mode 100644 index 0000000..e867c8f --- /dev/null +++ b/Zend/tests/bug67856.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #67856 (Leak when using array_reduce with by-ref function) +--FILE-- +<?php +$array = [1, 2, 3]; +var_dump(array_reduce($array, function(&$a, &$b) { + return $a + $b; +}, 0)); +?> +--EXPECT-- +int(6) diff --git a/ext/standard/array.c b/ext/standard/array.c index a177ee7..b503162 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -4298,14 +4298,18 @@ PHP_FUNCTION(array_reduce) fci.no_separation = 0; ZEND_HASH_FOREACH_VAL(htbl, operand) { - ZVAL_COPY_VALUE(&args[0], &result); - ZVAL_COPY_VALUE(&args[1], operand); + ZVAL_COPY(&args[0], &result); + ZVAL_COPY(&args[1], operand); fci.params = args; if (zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS && Z_TYPE(retval) != IS_UNDEF) { + zval_ptr_dtor(&args[1]); + zval_ptr_dtor(&args[0]); zval_ptr_dtor(&result); ZVAL_COPY_VALUE(&result, &retval); } else { + zval_ptr_dtor(&args[1]); + zval_ptr_dtor(&args[0]); php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the reduction callback"); return; }