diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2020-08-27 14:36:12 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-08-27 14:40:35 +0200 |
| commit | a2bbd8f01fd23e754340b61a6661e5a3152e9661 (patch) | |
| tree | 7c9413792c78c24fe221aa05cfe42d97ad899ba9 /Zend | |
| parent | e701146070e3287dc4519f543b2228ca54f4f029 (diff) | |
| download | php-git-a2bbd8f01fd23e754340b61a6661e5a3152e9661.tar.gz | |
Fix leak in typed reference assignment
We're only creating tmp here to compare against the existing
coerced_value. We need to destroy it in all cases.
Diffstat (limited to 'Zend')
| -rw-r--r-- | Zend/tests/type_declarations/typed_properties_reference_coercion_leak.phpt | 22 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 1 |
2 files changed, 23 insertions, 0 deletions
diff --git a/Zend/tests/type_declarations/typed_properties_reference_coercion_leak.phpt b/Zend/tests/type_declarations/typed_properties_reference_coercion_leak.phpt new file mode 100644 index 0000000000..57d09bef50 --- /dev/null +++ b/Zend/tests/type_declarations/typed_properties_reference_coercion_leak.phpt @@ -0,0 +1,22 @@ +--TEST-- +Do not leak when assigning to reference set with multiple typed properties with type coercion +--FILE-- +<?php + +class Test { + public string $x; + public string $y; +} + +$test = new Test; +$ref = ""; +$test->x =& $ref; +$test->y =& $ref; +$val = 42; +$ref = $val; +var_dump($ref, $val); + +?> +--EXPECT-- +string(2) "42" +int(42) diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 601b5221ee..bdcb2ce175 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -3133,6 +3133,7 @@ type_error: zval_ptr_dtor(&tmp); goto conflicting_coercion_error; } + zval_ptr_dtor(&tmp); } } else { if (!first_prop) { |