diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-26 13:47:41 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-26 13:47:41 +0200 |
| commit | d71f859a56757df16e20d72b22366a02ff9fec54 (patch) | |
| tree | 9f4688b5bd38b727e8dd147bf8153f108a02f78a | |
| parent | 247d5618aadfb32eba8fac8ee271fcbc9d1cc885 (diff) | |
| parent | 91c4abcfcc059e791b26733725b453b2bf230411 (diff) | |
| download | php-git-d71f859a56757df16e20d72b22366a02ff9fec54.tar.gz | |
Merge branch 'PHP-7.3' into PHP-7.4
| -rw-r--r-- | Zend/tests/pow_array_leak.phpt | 17 | ||||
| -rw-r--r-- | Zend/zend_operators.c | 9 |
2 files changed, 26 insertions, 0 deletions
diff --git a/Zend/tests/pow_array_leak.phpt b/Zend/tests/pow_array_leak.phpt new file mode 100644 index 0000000000..e9165bbbc5 --- /dev/null +++ b/Zend/tests/pow_array_leak.phpt @@ -0,0 +1,17 @@ +--TEST-- +Memory leak on ** with result==op1 array +--FILE-- +<?php + +$x = [0]; +$x **= 1; +var_dump($x); + +$x = [0]; +$x **= $x; +var_dump($x); + +?> +--EXPECT-- +int(0) +int(0) diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c index f1ebb2e5df..840ee75a41 100644 --- a/Zend/zend_operators.c +++ b/Zend/zend_operators.c @@ -1224,12 +1224,18 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* { if (EXPECTED(op1 != op2)) { if (Z_TYPE_P(op1) == IS_ARRAY) { + if (op1 == result) { + zval_ptr_dtor(result); + } ZVAL_LONG(result, 0); return SUCCESS; } else { op1 = zendi_convert_scalar_to_number(op1, &op1_copy, result, 0); } if (Z_TYPE_P(op2) == IS_ARRAY) { + if (op1 == result) { + zval_ptr_dtor(result); + } ZVAL_LONG(result, 1L); return SUCCESS; } else { @@ -1237,6 +1243,9 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* { } } else { if (Z_TYPE_P(op1) == IS_ARRAY) { + if (op1 == result) { + zval_ptr_dtor(result); + } ZVAL_LONG(result, 0); return SUCCESS; } else { |