Fix bug #27821 xml_parse segfaults when xml_set_object called from class method

fix memleaks in compat.c

2 files changed, 10 insertions, 2 deletions

diff --git a/ext/xml/compat.c b/ext/xml/compat.c
index e6590c6987..396393ee51 100644
--- a/ext/xml/compat.c
+++ b/ext/xml/compat.c
@@ -232,6 +232,7 @@ _comment_handler(void *user, const xmlChar *comment)
 
 		_build_comment(comment, xmlStrlen(comment), &d_comment, &d_comment_len);
 		parser->h_default(parser->user, d_comment, d_comment_len);
+		xmlFree(d_comment);
 	}
 }
 
@@ -257,6 +258,7 @@ _get_entity(void *user, const xmlChar *name)
 		
 		_build_entity(name, xmlStrlen(name), &entity, &len);
 		parser->h_default(parser->user, (const xmlChar *) entity, len);
+		xmlFree(entity);
 	}
 
 	return NULL;
diff --git a/ext/xml/xml.c b/ext/xml/xml.c
index 1f29585df0..f17601f8eb 100644
--- a/ext/xml/xml.c
+++ b/ext/xml/xml.c
@@ -380,6 +380,9 @@ static void xml_parser_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 	if (parser->baseURI) {
 		efree(parser->baseURI);
 	}
+	if (parser->object) {
+		zval_ptr_dtor(&parser->object);
+	}
 
 	efree(parser);
 }
@@ -1141,14 +1144,17 @@ PHP_FUNCTION(xml_set_object)
 	if (parser->object) {
 		zval_ptr_dtor(&parser->object);
 	}
-	
-	parser->object = *mythis;
 
 	/* please leave this commented - or ask thies@thieso.net before doing it (again) */
 /* #ifdef ZEND_ENGINE_2
 	zval_add_ref(&parser->object); 
 #endif */
 
+	ALLOC_ZVAL(parser->object);
+	*parser->object = **mythis;
+	zval_copy_ctor(parser->object);
+	INIT_PZVAL(parser->object);
+
 	RETVAL_TRUE;
 }
 /* }}} */