diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-04-15 13:16:16 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-04-15 13:21:45 +0200 |
| commit | 5fc71c7dba0f1cfd0647d95a86e74d2361beeeeb (patch) | |
| tree | 254b9f058c31cca6642089cc617b8c38c787e37c /ext/spl/spl_array.c | |
| parent | cb3cfc9ff8d2afabc00f7f2aa2751d205d889a31 (diff) | |
| download | php-git-5fc71c7dba0f1cfd0647d95a86e74d2361beeeeb.tar.gz | |
Correctly destroy reference in ArrayObject sort
The reference may be captured in an exception backtrace, in which
case the refcount may be more than one.
Diffstat (limited to 'ext/spl/spl_array.c')
| -rw-r--r-- | ext/spl/spl_array.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 2806f93281..284bb71c81 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1470,7 +1470,8 @@ exit: } else { GC_DELREF(aht); } - efree(Z_REF(params[0])); + ZVAL_NULL(Z_REFVAL(params[0])); + zval_ptr_dtor(¶ms[0]); zend_string_free(Z_STR(function_name)); } } /* }}} */ |