diff options
| author | Nikita Popov <nikic@php.net> | 2015-01-24 23:11:05 +0100 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2015-01-24 23:18:26 +0100 |
| commit | 6093c9370b943f7ba69ee74288ffedc29acd8f92 (patch) | |
| tree | e50df1128e29a071ad363967c951787e3b289227 /Zend | |
| parent | 05166566db19fb02d0b31eaa64238bf58299d222 (diff) | |
| download | php-git-6093c9370b943f7ba69ee74288ffedc29acd8f92.tar.gz | |
Fix resource leak when casting to string
Diffstat (limited to 'Zend')
| -rw-r--r-- | Zend/zend_operators.c | 14 | ||||
| -rw-r--r-- | Zend/zend_variables.c | 2 |
2 files changed, 8 insertions, 8 deletions
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c index 01732510a2..f178c34880 100644 --- a/Zend/zend_operators.c +++ b/Zend/zend_operators.c @@ -292,13 +292,10 @@ ZEND_API void convert_to_long_base(zval *op, int base) /* {{{ */ case IS_TRUE: ZVAL_LONG(op, 1); break; - case IS_RESOURCE: { - zend_long l = Z_RES_HANDLE_P(op); - zval_ptr_dtor(op); - ZVAL_LONG(op, l); - } - /* break missing intentionally */ - Z_TYPE_INFO_P(op) = IS_LONG; + case IS_RESOURCE: + tmp = Z_RES_HANDLE_P(op); + zval_ptr_dtor(op); + ZVAL_LONG(op, tmp); break; case IS_LONG: break; @@ -489,7 +486,7 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC) /* {{{ */ case IS_UNDEF: case IS_NULL: case IS_FALSE: { - ZVAL_EMPTY_STRING(op); + ZVAL_EMPTY_STRING(op); break; } case IS_TRUE: @@ -500,6 +497,7 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC) /* {{{ */ case IS_RESOURCE: { char buf[sizeof("Resource id #") + MAX_LENGTH_OF_LONG]; int len = snprintf(buf, sizeof(buf), "Resource id #" ZEND_LONG_FMT, (zend_long)Z_RES_HANDLE_P(op)); + zval_ptr_dtor(op); ZVAL_NEW_STR(op, zend_string_init(buf, len, 0)); break; } diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c index 9ada1e4a7c..6e9834475f 100644 --- a/Zend/zend_variables.c +++ b/Zend/zend_variables.c @@ -41,6 +41,8 @@ ZEND_API void _zval_dtor_func(zend_refcounted *p ZEND_FILE_LINE_DC) zend_array *arr = (zend_array*)p; if (arr != &EG(symbol_table)) { + ZEND_ASSERT(GC_REFCOUNT(arr) <= 1); + /* break possible cycles */ GC_TYPE(arr) = IS_NULL; GC_REMOVE_FROM_BUFFER(arr); |