diff options
-rw-r--r-- | NEWS | 2 | ||||
-rw-r--r-- | ext/standard/string.c | 1 | ||||
-rw-r--r-- | ext/standard/tests/strings/bug78612.phpt | 18 |
3 files changed, 21 insertions, 0 deletions
@@ -31,6 +31,8 @@ PHP NEWS - Standard: . Fixed bug #76342 (file_get_contents waits twice specified timeout). (Thomas Calvet) + . Fixed bug #78612 (strtr leaks memory when integer keys are used and the + subject string shorter). (Nikita) 26 Sep 2019, PHP 7.3.10 diff --git a/ext/standard/string.c b/ext/standard/string.c index dde97faf4d..0bb4d3a0a9 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -3068,6 +3068,7 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p len = ZSTR_LEN(key_used); if (UNEXPECTED(len > slen)) { /* skip long patterns */ + zend_string_release(key_used); continue; } if (len > maxlen) { diff --git a/ext/standard/tests/strings/bug78612.phpt b/ext/standard/tests/strings/bug78612.phpt new file mode 100644 index 0000000000..7dad605e80 --- /dev/null +++ b/ext/standard/tests/strings/bug78612.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #78612 (strtr leaks memory when integer keys are used and the subject string shorter). +--FILE-- +<?php + +$find_replace = array(); +$_a = 7111222333000001; +$_b = 5000001; + +for ($j=0; $j<10; $j++) { + $find_replace[$_a + $j] = $_b + $j; +} + +echo strtr('Hello', $find_replace), "\n"; + +?> +--EXPECT-- +Hello |