Revert "Fix return value memory leaks upon exceptions in opcode operand freeing"

This reverts commit 9ad9d7ae375a6e8847ceaab287d3d23e0963a06e.

1 files changed, 18 insertions, 74 deletions

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index c850c91766..8005577694 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -926,9 +926,6 @@ ZEND_API int ZEND_FASTCALL add_function(zval *result, zval *op1, zval *op2) /* {
 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
 					converted = 1;
 				} else {
-					if (result != op1) {
-						ZVAL_UNDEF(result);
-					}
 					zend_throw_error(NULL, "Unsupported operand types");
 					return FAILURE; /* unknown datatype */
 				}
@@ -971,9 +968,6 @@ ZEND_API int ZEND_FASTCALL sub_function(zval *result, zval *op1, zval *op2) /* {
 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
 					converted = 1;
 				} else {
-					if (result != op1) {
-						ZVAL_UNDEF(result);
-					}
 					zend_throw_error(NULL, "Unsupported operand types");
 					return FAILURE; /* unknown datatype */
 				}
@@ -1021,9 +1015,6 @@ ZEND_API int ZEND_FASTCALL mul_function(zval *result, zval *op1, zval *op2) /* {
 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
 					converted = 1;
 				} else {
-					if (result != op1) {
-						ZVAL_UNDEF(result);
-					}
 					zend_throw_error(NULL, "Unsupported operand types");
 					return FAILURE; /* unknown datatype */
 				}
@@ -1112,9 +1103,6 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
 					}
 					converted = 1;
 				} else {
-					if (result != op1) {
-						ZVAL_UNDEF(result);
-					}
 					zend_throw_error(NULL, "Unsupported operand types");
 					return FAILURE;
 				}
@@ -1180,9 +1168,6 @@ ZEND_API int ZEND_FASTCALL div_function(zval *result, zval *op1, zval *op2) /* {
 					zendi_convert_scalar_to_number(op2, op2_copy, result, 0);
 					converted = 1;
 				} else {
-					if (result != op1) {
-						ZVAL_UNDEF(result);
-					}
 					zend_throw_error(NULL, "Unsupported operand types");
 					return FAILURE; /* unknown datatype */
 				}
@@ -1197,6 +1182,10 @@ ZEND_API int ZEND_FASTCALL mod_function(zval *result, zval *op1, zval *op2) /* {
 
 	convert_op1_op2_long(op1, op1_lval, op2, op2_lval, ZEND_MOD, mod_function);
 
+	if (op1 == result) {
+		zval_dtor(result);
+	}
+
 	if (op2_lval == 0) {
 		/* modulus by zero */
 		if (EG(current_execute_data) && !CG(in_compilation)) {
@@ -1204,16 +1193,10 @@ ZEND_API int ZEND_FASTCALL mod_function(zval *result, zval *op1, zval *op2) /* {
 		} else {
 			zend_error_noreturn(E_ERROR, "Modulo by zero");
 		}
-		if (op1 != result) {
-			ZVAL_UNDEF(result);
-		}
+		ZVAL_UNDEF(result);
 		return FAILURE;
 	}
 
-	if (op1 == result) {
-		zval_dtor(result);
-	}
-
 	if (op2_lval == -1) {
 		/* Prevent overflow error/crash if op1==LONG_MIN */
 		ZVAL_LONG(result, 0);
@@ -1335,9 +1318,6 @@ try_again:
 		default:
 			ZEND_TRY_UNARY_OBJECT_OPERATION(ZEND_BW_NOT);
 
-			if (result != op1) {
-				ZVAL_UNDEF(result);
-			}
 			zend_throw_error(NULL, "Unsupported operand types");
 			return FAILURE;
 	}
@@ -1364,9 +1344,6 @@ ZEND_API int ZEND_FASTCALL bitwise_or_function(zval *result, zval *op1, zval *op
 		if (EXPECTED(Z_STRLEN_P(op1) >= Z_STRLEN_P(op2))) {
 			if (EXPECTED(Z_STRLEN_P(op1) == Z_STRLEN_P(op2)) && Z_STRLEN_P(op1) == 1) {
 				zend_uchar or = (zend_uchar) (*Z_STRVAL_P(op1) | *Z_STRVAL_P(op2));
-				if (result==op1) {
-					zend_string_release(Z_STR_P(result));
-				}
 				if (CG(one_char_string)[or]) {
 					ZVAL_INTERNED_STR(result, CG(one_char_string)[or]);
 				} else {
@@ -1434,9 +1411,6 @@ ZEND_API int ZEND_FASTCALL bitwise_and_function(zval *result, zval *op1, zval *o
 		if (EXPECTED(Z_STRLEN_P(op1) >= Z_STRLEN_P(op2))) {
 			if (EXPECTED(Z_STRLEN_P(op1) == Z_STRLEN_P(op2)) && Z_STRLEN_P(op1) == 1) {
 				zend_uchar and = (zend_uchar) (*Z_STRVAL_P(op1) & *Z_STRVAL_P(op2));
-				if (result==op1) {
-					zend_string_release(Z_STR_P(result));
-				}
 				if (CG(one_char_string)[and]) {
 					ZVAL_INTERNED_STR(result, CG(one_char_string)[and]);
 				} else {
@@ -1504,9 +1478,6 @@ ZEND_API int ZEND_FASTCALL bitwise_xor_function(zval *result, zval *op1, zval *o
 		if (EXPECTED(Z_STRLEN_P(op1) >= Z_STRLEN_P(op2))) {
 			if (EXPECTED(Z_STRLEN_P(op1) == Z_STRLEN_P(op2)) && Z_STRLEN_P(op1) == 1) {
 				zend_uchar xor = (zend_uchar) (*Z_STRVAL_P(op1) ^ *Z_STRVAL_P(op2));
-				if (result==op1) {
-					zend_string_release(Z_STR_P(result));
-				}
 				if (CG(one_char_string)[xor]) {
 					ZVAL_INTERNED_STR(result, CG(one_char_string)[xor]);
 				} else {
@@ -1560,13 +1531,13 @@ ZEND_API int ZEND_FASTCALL shift_left_function(zval *result, zval *op1, zval *op
 
 	convert_op1_op2_long(op1, op1_lval, op2, op2_lval, ZEND_SL, shift_left_function);
 
+	if (op1 == result) {
+		zval_dtor(result);
+	}
+
 	/* prevent wrapping quirkiness on some processors where << 64 + x == << x */
 	if (UNEXPECTED((zend_ulong)op2_lval >= SIZEOF_ZEND_LONG * 8)) {
 		if (EXPECTED(op2_lval > 0)) {
-			if (op1 == result) {
-				zval_dtor(result);
-			}
-
 			ZVAL_LONG(result, 0);
 			return SUCCESS;
 		} else {
@@ -1575,17 +1546,11 @@ ZEND_API int ZEND_FASTCALL shift_left_function(zval *result, zval *op1, zval *op
 			} else {
 				zend_error_noreturn(E_ERROR, "Bit shift by negative number");
 			}
-			if (op1 != result) {
-				ZVAL_UNDEF(result);
-			}
+			ZVAL_UNDEF(result);
 			return FAILURE;
 		}
 	}
 
-	if (op1 == result) {
-		zval_dtor(result);
-	}
-
 	ZVAL_LONG(result, op1_lval << op2_lval);
 	return SUCCESS;
 }
@@ -1597,13 +1562,13 @@ ZEND_API int ZEND_FASTCALL shift_right_function(zval *result, zval *op1, zval *o
 
 	convert_op1_op2_long(op1, op1_lval, op2, op2_lval, ZEND_SR, shift_right_function);
 
+	if (op1 == result) {
+		zval_dtor(result);
+	}
+
 	/* prevent wrapping quirkiness on some processors where >> 64 + x == >> x */
 	if (UNEXPECTED((zend_ulong)op2_lval >= SIZEOF_ZEND_LONG * 8)) {
 		if (EXPECTED(op2_lval > 0)) {
-			if (op1 == result) {
-				zval_dtor(result);
-			}
-
 			ZVAL_LONG(result, (op1_lval < 0) ? -1 : 0);
 			return SUCCESS;
 		} else {
@@ -1612,17 +1577,11 @@ ZEND_API int ZEND_FASTCALL shift_right_function(zval *result, zval *op1, zval *o
 			} else {
 				zend_error_noreturn(E_ERROR, "Bit shift by negative number");
 			}
-			if (op1 != result) {
-				ZVAL_UNDEF(result);
-			}
+			ZVAL_UNDEF(result);
 			return FAILURE;
 		}
 	}
 
-	if (op1 == result) {
-		zval_dtor(result);
-	}
-
 	ZVAL_LONG(result, op1_lval >> op2_lval);
 	return SUCCESS;
 }
@@ -1630,7 +1589,7 @@ ZEND_API int ZEND_FASTCALL shift_right_function(zval *result, zval *op1, zval *o
 
 ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /* {{{ */
 {
-	zval op1_copy, op2_copy, orig_op1;
+	zval op1_copy, op2_copy;
 	int use_copy1 = 0, use_copy2 = 0;
 
 	do {
@@ -1646,12 +1605,10 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
 				 * we have to free it.
 				 */
 				if (result == op1) {
-					ZVAL_COPY_VALUE(&orig_op1, result);
+					zval_dtor(op1);
 					if (UNEXPECTED(op1 == op2)) {
 						op2 = &op1_copy;
 					}
-				} else {
-					ZVAL_UNDEF(&orig_op1);
 				}
 				op1 = &op1_copy;
 			}
@@ -1679,19 +1636,7 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
 
 		if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
 			zend_throw_error(NULL, "String size overflow");
-
-			if (UNEXPECTED(use_copy1)) {
-				zval_dtor(op1);
-				if (Z_ISUNDEF(orig_op1)) {
-					ZVAL_UNDEF(result);
-				}
-			} else if (result != op1) {
-				ZVAL_UNDEF(result);
-			}
-			if (UNEXPECTED(use_copy2)) {
-				zval_dtor(op2);
-			}
-
+			ZVAL_FALSE(result);
 			return FAILURE;
 		}
 
@@ -1714,7 +1659,6 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
 
 	if (UNEXPECTED(use_copy1)) {
 		zval_dtor(op1);
-		zval_dtor(&orig_op1);
 	}
 	if (UNEXPECTED(use_copy2)) {
 		zval_dtor(op2);