diff options
| author | Xinchen Hui <laruence@php.net> | 2012-02-12 04:59:08 +0000 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2012-02-12 04:59:08 +0000 |
| commit | c578917e306b452493fed4a0aa2ecbd3a8c3f252 (patch) | |
| tree | d75a0079bf3a6db1fbebf6f7167c6bf8e8559419 /ext/standard/array.c | |
| parent | 2e61d04f49a12fa76e4669a13f9fea110578de5f (diff) | |
| download | php-git-c578917e306b452493fed4a0aa2ecbd3a8c3f252.tar.gz | |
Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX)
Diffstat (limited to 'ext/standard/array.c')
| -rw-r--r-- | ext/standard/array.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/ext/standard/array.c b/ext/standard/array.c index 060d665195..3ca1a69a5e 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1558,11 +1558,15 @@ PHP_FUNCTION(array_fill) num--; zval_add_ref(&val); - zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL); + if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) { + zval_ptr_dtor(&val); + } while (num--) { zval_add_ref(&val); - zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL); + if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) { + zval_ptr_dtor(&val); + } } } /* }}} */ |