diff options
| -rw-r--r-- | ext/standard/scanf.c | 2 | ||||
| -rw-r--r-- | ext/standard/tests/strings/bug27295.phpt | 14 |
2 files changed, 15 insertions, 1 deletions
diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c index 675cef897b..ba158e598c 100644 --- a/ext/standard/scanf.c +++ b/ext/standard/scanf.c @@ -933,7 +933,7 @@ PHPAPI int php_sscanf_internal( char *string, char *format, if (!(flags & SCAN_SUPPRESS)) { if (numVars) { current = args[objIndex++]; - convert_to_string( *current ); + zval_dtor( *current ); ZVAL_STRINGL( *current, string, end-string, 1); } else { add_index_stringl(*return_value, objIndex++, string, end-string, 1); diff --git a/ext/standard/tests/strings/bug27295.phpt b/ext/standard/tests/strings/bug27295.phpt new file mode 100644 index 0000000000..d23d27049f --- /dev/null +++ b/ext/standard/tests/strings/bug27295.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #27295 (memory leak inside sscanf()) +--FILE-- +<?php +$strings = array("foo = bar", "bar = foo"); +foreach( $strings as $string ) +{ + sscanf( $string, "%s = %[^[]]", $var, $val ); + echo "$var = $val\n"; +} +?> +--EXPECT-- +foo = bar +bar = foo |