MFH (fixes memleaks in element->get_elements_by_tagname & document->get_elements_by_tagname)

1 files changed, 11 insertions, 0 deletions

diff --git a/ext/domxml/php_domxml.c b/ext/domxml/php_domxml.c
index 4db699dbc6..bf3c5cb7f5 100644
--- a/ext/domxml/php_domxml.c
+++ b/ext/domxml/php_domxml.c
@@ -2981,6 +2981,7 @@ PHP_FUNCTION(domxml_doc_get_elements_by_tagname)
 	xmlXPathObjectPtr xpathobjp;
 	xmlNode *contextnodep;
 	int name_len;
+	int free_context = 0;
 	char *str,*name;
 
 	contextnode = NULL;
@@ -2991,6 +2992,7 @@ PHP_FUNCTION(domxml_doc_get_elements_by_tagname)
 	/* if no xpath_context was submitted, create a new one */
 	if (ctxpin == NULL) {
 		ctxp = xmlXPathNewContext(docp);
+		free_context = 1;
 	} else {
 		DOMXML_GET_OBJ(ctxp, ctxpin, le_xpathctxp);
 	}
@@ -3028,6 +3030,10 @@ PHP_FUNCTION(domxml_doc_get_elements_by_tagname)
 
 			if (NULL == (nodesetp = xpathobjp->nodesetval)) {
 				zval_dtor(rv);
+				xmlXPathFreeObject (xpathobjp);
+				if (free_context) {
+					xmlXPathFreeContext(ctxp);
+				}
 				RETURN_FALSE;
 			}
 
@@ -3047,6 +3053,10 @@ PHP_FUNCTION(domxml_doc_get_elements_by_tagname)
 			break;
 	}
 
+	xmlXPathFreeObject(xpathobjp);
+	if (free_context) {
+		xmlXPathFreeContext(ctxp);
+	}
 	*return_value = *rv;
 	FREE_ZVAL(rv);
 }
@@ -3125,6 +3135,7 @@ PHP_FUNCTION(domxml_elem_get_elements_by_tagname)
 			zend_hash_next_index_insert(Z_ARRVAL_P(rv), &child, sizeof(zval *), NULL);
 		}
 	}
+	xmlXPathFreeNodeSet(nodesetp);
 	*return_value = *rv;
 	FREE_ZVAL(rv);