diff options
| author | Nikita Popov <nikic@php.net> | 2016-02-24 17:39:16 +0100 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2016-02-24 17:39:16 +0100 |
| commit | eb885e9d6ebc6670d1ccc6d5c0fa26e411ffb0fb (patch) | |
| tree | 4c6cdd5ea6423b5cbdec9d439197e21a2f9fa64e /ext/spl/spl_array.c | |
| parent | ea02f5765608c13cb92b5b7879878b981c99b33e (diff) | |
| download | php-git-eb885e9d6ebc6670d1ccc6d5c0fa26e411ffb0fb.tar.gz | |
Fix leak on assignment to illegal AO offset
Diffstat (limited to 'ext/spl/spl_array.c')
| -rw-r--r-- | ext/spl/spl_array.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 9ddd38bccf..0740c063e9 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -439,19 +439,16 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval return; } + if (Z_REFCOUNTED_P(value)) { + Z_ADDREF_P(value); + } + if (!offset) { ht = spl_array_get_hash_table(intern); - if (Z_REFCOUNTED_P(value)) { - Z_ADDREF_P(value); - } zend_hash_next_index_insert(ht, value); return; } - if (Z_REFCOUNTED_P(value)) { - Z_ADDREF_P(value); - } - try_again: switch (Z_TYPE_P(offset)) { case IS_STRING: @@ -485,6 +482,7 @@ num_index: goto try_again; default: zend_error(E_WARNING, "Illegal offset type"); + zval_ptr_dtor(value); return; } } /* }}} */ |