Fixed #66091

3 files changed, 24 insertions, 15 deletions

diff --git a/NEWS b/NEWS
index c383db1451..2429492cc6 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads)
     (Daniel Lowrey).
 
+- Date:
+  . Fixed bug #66091 (memory leaks in DateTime constructor) (Tjerk).
+
 ?? ??? 2014, PHP 5.4.32
 
 - COM:
diff --git a/ext/date/php_date.c b/ext/date/php_date.c
index 4259bf0fcb..92e9480a43 100644
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
@@ -2398,11 +2398,7 @@ static void date_object_free_storage_period(void *object TSRMLS_DC)
 /* Advanced Interface */
 PHPAPI zval *php_date_instantiate(zend_class_entry *pce, zval *object TSRMLS_DC)
 {
-	Z_TYPE_P(object) = IS_OBJECT;
 	object_init_ex(object, pce);
-	Z_SET_REFCOUNT_P(object, 1);
-	Z_UNSET_ISREF_P(object);
-
 	return object;
 }
 
@@ -2510,14 +2506,19 @@ PHP_FUNCTION(date_create)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL;
 	int             time_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sO!", &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2530,14 +2531,19 @@ PHP_FUNCTION(date_create_from_format)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL, *format_str = NULL;
 	int             time_str_len = 0, format_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|O", &format_str, &format_str_len, &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2560,7 +2566,7 @@ PHP_METHOD(DateTime, __construct)
 }
 /* }}} */
 
-static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
+static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
 {
 	zval            **z_date = NULL;
 	zval            **z_timezone = NULL;
@@ -2630,7 +2636,7 @@ PHP_METHOD(DateTime, __set_state)
 
 	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
 	dateobj = (php_date_obj *) zend_object_store_get_object(return_value TSRMLS_CC);
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }
@@ -2648,7 +2654,7 @@ PHP_METHOD(DateTime, __wakeup)
 
 	myht = Z_OBJPROP_P(object);
 
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }
diff --git a/ext/date/tests/bug51866.phpt b/ext/date/tests/bug51866.phpt
index 9474f4f58d..9481aebe9d 100644
--- a/ext/date/tests/bug51866.phpt
+++ b/ext/date/tests/bug51866.phpt
@@ -44,7 +44,7 @@ array(4) {
 
 string(6) "Y-m-d+"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -70,7 +70,7 @@ array(4) {
 
 string(7) "Y-m-d +"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#3 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -96,7 +96,7 @@ array(4) {
 
 string(6) "Y-m-d+"
 string(10) "2001-11-29"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -139,7 +139,7 @@ array(4) {
 
 string(7) "Y-m-d +"
 string(11) "2001-11-29 "
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>