fix bug #36898 (__set() leaks in classes extending internal ones)

Added:
ZEND_API void zend_object_std_init(zend_object *object, zend_class_entry *ce TSRMLS_DC)
ZEND_API void zend_object_std_dtor(zend_object *object TSRMLS_DC)

to initialize and destroy zend_object structs

1 files changed, 2 insertions, 5 deletions

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 8e4045f6c4..4b17419246 100755
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -103,8 +103,7 @@ static void spl_array_object_free_storage(void *object TSRMLS_DC)
 {
 	spl_array_object *intern = (spl_array_object *)object;
 
-	zend_hash_destroy(intern->std.properties);
-	FREE_HASHTABLE(intern->std.properties);
+	zend_object_std_dtor(&intern->std TSRMLS_CC);
 
 	zval_ptr_dtor(&intern->array);
 	zval_ptr_dtor(&intern->retval);
@@ -124,12 +123,10 @@ static zend_object_value spl_array_object_new_ex(zend_class_entry *class_type, s
 
 	intern = emalloc(sizeof(spl_array_object));
 	memset(intern, 0, sizeof(spl_array_object));
-	intern->std.ce = class_type;
 	*obj = intern;
 	ALLOC_INIT_ZVAL(intern->retval);
 
-	ALLOC_HASHTABLE(intern->std.properties);
-	zend_hash_init(intern->std.properties, 0, NULL, ZVAL_PTR_DTOR, 0);
+	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	zend_hash_copy(intern->std.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 
 	intern->ar_flags = 0;