From cdb7aafc23bd1fd396305df9cddca1717b58f2b3 Mon Sep 17 00:00:00 2001 From: Tyson Andre Date: Sun, 20 Nov 2016 15:18:32 -0800 Subject: Fix memory leak(null coalescing operator with Spl hash) The SEPARATE_ARG_IF_REF macro increased the refcount of the object passed as a key. However, when the key did not exist in the ArrayAccess implementation, the code returned early without trying to decrement the refcount. Add a test of `??` succeeding+failing on a SplObjectStorage instance. --- Zend/zend_object_handlers.c | 2 ++ ext/spl/tests/observer_010.phpt | 15 +++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 ext/spl/tests/observer_010.phpt diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index 70dab660b3..af92d67496 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -736,9 +736,11 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /* if (type == BP_VAR_IS) { zend_call_method_with_1_params(object, ce, NULL, "offsetexists", rv, offset); if (UNEXPECTED(Z_ISUNDEF_P(rv))) { + zval_ptr_dtor(offset); return NULL; } if (!i_zend_is_true(rv)) { + zval_ptr_dtor(offset); zval_ptr_dtor(rv); return &EG(uninitialized_zval); } diff --git a/ext/spl/tests/observer_010.phpt b/ext/spl/tests/observer_010.phpt new file mode 100644 index 0000000000..5cedff8c7c --- /dev/null +++ b/ext/spl/tests/observer_010.phpt @@ -0,0 +1,15 @@ +--TEST-- +SPL: SplObjectStorage null coalescing operator memory leak +--FILE-- +