- Fix various memory leaks.

4 files changed, 27 insertions, 18 deletions

diff --git a/Zend/zend-parser.y b/Zend/zend-parser.y
index 1fab94d93d..3f12046352 100644
--- a/Zend/zend-parser.y
+++ b/Zend/zend-parser.y
@@ -605,7 +605,7 @@ encaps_list:
 
 encaps_var:
 		VARIABLE { do_fetch_globals(&$1); do_begin_variable_parse(CLS_C); fetch_simple_variable(&$$, &$1, 1 CLS_CC); }
-	|	VARIABLE '[' encaps_var_offset ']'	{ do_fetch_globals(&$1); do_begin_variable_parse(CLS_C); fetch_array_begin(&$$, &$1, &$3 CLS_CC); }
+	|	VARIABLE '[' { do_begin_variable_parse(CLS_C); } encaps_var_offset ']'	{ do_fetch_globals(&$1);  fetch_array_begin(&$$, &$1, &$4 CLS_CC); }
 	|	VARIABLE ZEND_OBJECT_OPERATOR STRING { do_begin_variable_parse(CLS_C); fetch_simple_variable(&$2, &$1, 1 CLS_CC); do_fetch_property(&$$, &$2, &$3 CLS_CC); }
 	|	DOLLAR_OPEN_CURLY_BRACES expr '}' { do_begin_variable_parse(CLS_C);  fetch_simple_variable(&$$, &$2, 1 CLS_CC); }
 	|	DOLLAR_OPEN_CURLY_BRACES STRING '[' expr ']' '}' { do_begin_variable_parse(CLS_C);  fetch_array_begin(&$$, &$2, &$4 CLS_CC); }
@@ -616,7 +616,7 @@ encaps_var:
 encaps_var_offset:
 		STRING	{ $$ = $1; }
 	|	NUM_STRING	{ $$ = $1; }
-	|	{ do_begin_variable_parse(CLS_C); } VARIABLE { fetch_simple_variable(&$$, &$2, 1 CLS_CC); }
+	|	VARIABLE { fetch_simple_variable(&$$, &$1, 1 CLS_CC); }
 ;
 
 
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 5d16f370c1..d1e4a92088 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -937,12 +937,17 @@ void do_brk_cont(int op, znode *expr CLS_DC)
 void do_switch_cond(znode *cond CLS_DC)
 {
 	zend_switch_entry switch_entry;
+	zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
 
 	switch_entry.cond = *cond;
 	switch_entry.default_case = -1;
 	switch_entry.control_var = -1;
 	zend_stack_push(&CG(switch_cond_stack), (void *) &switch_entry, sizeof(switch_entry));
 
+	if (opline->result.op_type == IS_VAR) {
+		opline->result.u.EA.type |= EXT_TYPE_UNUSED;
+	}
+
 	do_begin_loop(CLS_C);
 
 	INC_BPC(CG(active_op_array));
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index b66235f97a..cd1472a1bd 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1552,6 +1552,9 @@ send_by_ref:
 				}
 				break;
 			case ZEND_CASE:
+				if (opline->op1.op_type == IS_VAR) {
+					EG(AiCount)++;
+				}
 				is_equal_function(&Ts[opline->result.u.var].tmp_var, 
 							 get_zval_ptr(&opline->op1, Ts, &free_op1, BP_VAR_R),
 							 get_zval_ptr(&opline->op2, Ts, &free_op2, BP_VAR_R) );
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index e10be7d706..0b02007642 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -278,8 +278,6 @@ int call_user_function(HashTable *function_table, zval *object, zval *function_n
 		return FAILURE;
 	}
 
-	function_state.function_symbol_table = (HashTable *) emalloc(sizeof(HashTable));
-	zend_hash_init(function_state.function_symbol_table, 0, NULL, PVAL_PTR_DTOR, 0);
 
 	for (i=0; i<param_count; i++) {
 		zval *param;
@@ -293,35 +291,38 @@ int call_user_function(HashTable *function_table, zval *object, zval *function_n
 		zend_ptr_stack_push(&EG(argument_stack), param);
 	}
 
-	if (object) {
-		zval *dummy = (zval *) emalloc(sizeof(zval)), **this_ptr;
-
-		var_uninit(dummy);
-		dummy->refcount=1;
-		dummy->is_ref=0;
-		zend_hash_update_ptr(function_state.function_symbol_table, "this", sizeof("this"), dummy, sizeof(zval *), (void **) &this_ptr);
-		zend_assign_to_variable_reference(NULL, this_ptr, &object, NULL ELS_CC);
-	}
+	zend_ptr_stack_push(&EG(argument_stack), (void *) param_count);
 
-	calling_symbol_table = EG(active_symbol_table);
-	EG(active_symbol_table) = function_state.function_symbol_table;
 	var_uninit(retval);
 	if (function_state.function->type == ZEND_USER_FUNCTION) {
+		calling_symbol_table = EG(active_symbol_table);
+		EG(active_symbol_table) = (HashTable *) emalloc(sizeof(HashTable));
+		zend_hash_init(EG(active_symbol_table), 0, NULL, PVAL_PTR_DTOR, 0);
+		if (object) {
+			zval *dummy = (zval *) emalloc(sizeof(zval)), **this_ptr;
+
+			var_uninit(dummy);
+			dummy->refcount=1;
+			dummy->is_ref=0;
+			zend_hash_update_ptr(EG(active_symbol_table), "this", sizeof("this"), dummy, sizeof(zval *), (void **) &this_ptr);
+			zend_assign_to_variable_reference(NULL, this_ptr, &object, NULL ELS_CC);
+		}
 		original_return_value = EG(return_value);
 		original_op_array = EG(active_op_array);
 		EG(return_value) = retval;
 		EG(active_op_array) = (zend_op_array *) function_state.function;
 		original_opline_ptr = EG(opline_ptr);	
 		zend_execute(EG(active_op_array) ELS_CC);
+		zend_hash_destroy(EG(active_symbol_table));		
+		efree(EG(active_symbol_table));
+		EG(active_symbol_table) = calling_symbol_table;
 		EG(active_op_array) = original_op_array;
 		EG(return_value)=original_return_value;
 		EG(opline_ptr) = original_opline_ptr;
 	} else {
 		((zend_internal_function *) function_state.function)->handler(param_count, retval, &EG(regular_list), &EG(persistent_list));
 	}
-	zend_hash_destroy(EG(active_symbol_table));
-	efree(EG(active_symbol_table));
-	EG(active_symbol_table) = calling_symbol_table;
+	zend_ptr_stack_clear_multiple(ELS_C);
 	EG(function_state_ptr) = original_function_state_ptr;
 
 	return SUCCESS;