Fixed memory leak

2 files changed, 15 insertions, 3 deletions

diff --git a/NEWS b/NEWS
index 48b2180097..7b9bc11edb 100644
--- a/NEWS
+++ b/NEWS
@@ -31,6 +31,7 @@ PHP                                                                        NEWS
   . Implemented FR #54172 (Overriding the pid file location of php-fpm). (fat)
   . Fixed missing Expires and Cache-Control headers for ping and status pages.
     (fat)
+  . Fixed memory leak. (fat) Reported and fixed by Giovanni Giacobbi.
 
 - SPL extension:
   . Fixed bug #54971 (Wrong result when using iterator_to_array with use_keys
diff --git a/sapi/fpm/fpm/fpm_conf.c b/sapi/fpm/fpm/fpm_conf.c
index cc7baea31e..9e52c79449 100644
--- a/sapi/fpm/fpm/fpm_conf.c
+++ b/sapi/fpm/fpm/fpm_conf.c
@@ -123,6 +123,9 @@ static int fpm_conf_is_dir(char *path) /* {{{ */
 }
 /* }}} */
 
+/*
+ * Expands the '$pool' token in a dynamically allocated string
+ */
 static int fpm_conf_expand_pool_name(char **value) {
 	char *token;
 
@@ -130,15 +133,23 @@ static int fpm_conf_expand_pool_name(char **value) {
 		return 0;
 	}
 
-	while ((token = strstr(*value, "$pool"))) {
+	while (*value && (token = strstr(*value, "$pool"))) {
 		char *buf;
-		char *p1 = *value;
 		char *p2 = token + strlen("$pool");
+
+		/* If we are not in a pool, we cannot expand this name now */
 		if (!current_wp || !current_wp->config  || !current_wp->config->name) {
 			return -1;
 		}
+
+		/* "aaa$poolbbb" becomes "aaa\0oolbbb" */
 		token[0] = '\0';
-		spprintf(&buf, 0, "%s%s%s", p1, current_wp->config->name, p2);
+
+		/* Build a brand new string with the expanded token */
+		spprintf(&buf, 0, "%s%s%s", *value, current_wp->config->name, p2);
+
+		/* Free the previous value and save the new one */
+		free(*value);
 		*value = strdup(buf);
 		efree(buf);
 	}