diff options
| author | Xinchen Hui <laruence@php.net> | 2012-02-12 05:32:24 +0000 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2012-02-12 05:32:24 +0000 |
| commit | 33125e2312045e26853c5a44f255d56b9742edaf (patch) | |
| tree | 33c76cbe0637873e5247b4a43591667f3907693e | |
| parent | c578917e306b452493fed4a0aa2ecbd3a8c3f252 (diff) | |
| download | php-git-33125e2312045e26853c5a44f255d56b9742edaf.tar.gz | |
Improved fix for #61058, and add test script
| -rw-r--r-- | ext/standard/array.c | 15 | ||||
| -rw-r--r-- | ext/standard/tests/array/bug61058.phpt | 8 |
2 files changed, 16 insertions, 7 deletions
diff --git a/ext/standard/array.c b/ext/standard/array.c index 3ca1a69a5e..f18d558bbe 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1557,15 +1557,16 @@ PHP_FUNCTION(array_fill) array_init_size(return_value, num); num--; - zval_add_ref(&val); - if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) { - zval_ptr_dtor(&val); - } + zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL); + zval_add_ref(&val); while (num--) { - zval_add_ref(&val); - if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) { - zval_ptr_dtor(&val); + if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == SUCCESS) { + zval_add_ref(&val); + } else { + zval_dtor(return_value); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot add element to the array as the next element is already occupied"); + RETURN_FALSE; } } } diff --git a/ext/standard/tests/array/bug61058.phpt b/ext/standard/tests/array/bug61058.phpt new file mode 100644 index 0000000000..1f0f6fe630 --- /dev/null +++ b/ext/standard/tests/array/bug61058.phpt @@ -0,0 +1,8 @@ +--TEST-- +Bug #61058 (array_fill leaks if start index is PHP_INT_MAX) +--FILE-- +<?php +array_fill(PHP_INT_MAX, 2, '*'); +?> +--EXPECTF-- +Warning: array_fill(): Cannot add element to the array as the next element is already occupied in %sbug61058.php on line %d |