Merge branch 'PHP-7.1'

* PHP-7.1:
  improve fix
  fix leak
  fix leak

3 files changed, 32 insertions, 4 deletions

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 941cd4cebd..f3e98a6d96 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -665,6 +665,7 @@ PHP_METHOD(Phar, webPhar)
 			if (free_pathinfo) {
 				efree(path_info);
 			}
+			efree(pt);
 
 			return;
 		}
@@ -682,6 +683,7 @@ PHP_METHOD(Phar, webPhar)
 			if (free_pathinfo) {
 				efree(path_info);
 			}
+			efree(pt);
 
 			return;
 		}
@@ -691,6 +693,7 @@ PHP_METHOD(Phar, webPhar)
 				efree(path_info);
 			}
 			zend_throw_exception_ex(phar_ce_PharException, 0, "phar error: rewrite callback must return a string or false");
+			efree(pt);
 			return;
 		}
 
@@ -707,6 +710,7 @@ PHP_METHOD(Phar, webPhar)
 				if (free_pathinfo) {
 					efree(path_info);
 				}
+				efree(pt);
 
 				zend_bailout();
 				return;
@@ -714,6 +718,7 @@ PHP_METHOD(Phar, webPhar)
 				if (free_pathinfo) {
 					efree(path_info);
 				}
+				efree(pt);
 
 				zend_throw_exception_ex(phar_ce_PharException, 0, "phar error: rewrite callback must return a string or false");
 				return;
diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index e40739726b..8386623b84 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -959,6 +959,8 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int
 	entry.tar_type = '0';
 	entry.phar = phar;
 	entry.fp_type = PHAR_MOD;
+	entry.fp = NULL;
+	entry.filename = NULL;
 
 	if (phar->is_persistent) {
 		if (error) {
@@ -977,6 +979,7 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int
 		entry.filename_len = sizeof(".phar/alias.txt")-1;
 		entry.fp = php_stream_fopen_tmpfile();
 		if (entry.fp == NULL) {
+			efree(entry.filename);
 			spprintf(error, 0, "phar error: unable to create temporary file");
 			return -1;
 		}
@@ -984,6 +987,8 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int
 			if (error) {
 				spprintf(error, 0, "unable to set alias in tar-based phar \"%s\"", phar->fname);
 			}
+			php_stream_close(entry.fp);
+			efree(entry.filename);
 			return EOF;
 		}
 
@@ -993,6 +998,8 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int
 			if (error) {
 				spprintf(error, 0, "unable to set alias in tar-based phar \"%s\"", phar->fname);
 			}
+			php_stream_close(entry.fp);
+			efree(entry.filename);
 			return EOF;
 		}
 	} else {
@@ -1008,6 +1015,12 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int
 				if (error) {
 					spprintf(error, 0, "unable to access resource to copy stub to new tar-based phar \"%s\"", phar->fname);
 				}
+				if (entry.fp) {
+					php_stream_close(entry.fp);
+				}
+				if (entry.filename) {
+					efree(entry.filename);
+				}
 				return EOF;
 			}
 			if (len == -1) {
@@ -1035,6 +1048,12 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int
 				if (error) {
 					spprintf(error, 0, "unable to read resource to copy stub to new tar-based phar \"%s\"", phar->fname);
 				}
+				if (entry.fp) {
+					php_stream_close(entry.fp);
+				}
+				if (entry.filename) {
+					efree(entry.filename);
+				}
 				return EOF;
 			}
 			free_user_stub = 1;
@@ -1051,6 +1070,12 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int
 			if (free_user_stub) {
 				efree(user_stub);
 			}
+			if (entry.fp) {
+				php_stream_close(entry.fp);
+			}
+			if (entry.filename) {
+				efree(entry.filename);
+			}
 			return EOF;
 		}
 		pos = user_stub + (pos - tmp);
diff --git a/ext/standard/image.c b/ext/standard/image.c
index c5616d1119..480246ab97 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -207,18 +207,16 @@ static struct gfxinfo *php_handle_swc(php_stream * stream)
 	unsigned char *b, *buf = NULL;
 	zend_string *bufz;
 
-	b = ecalloc(1, len + 1);
-
 	if (php_stream_seek(stream, 5, SEEK_CUR)) {
-		efree(b);
 		return NULL;
 	}
 
 	if (php_stream_read(stream, (char *) a, sizeof(a)) != sizeof(a)) {
-		efree(b);
 		return NULL;
 	}
 
+	b = ecalloc(1, len + 1);
+
 	if (uncompress(b, &len, a, sizeof(a)) != Z_OK) {
 		/* failed to decompress the file, will try reading the rest of the file */
 		if (php_stream_seek(stream, 8, SEEK_SET)) {