diff options
| -rw-r--r-- | Zend/tests/bug67856.phpt | 11 | ||||
| -rw-r--r-- | ext/standard/array.c | 8 |
2 files changed, 17 insertions, 2 deletions
diff --git a/Zend/tests/bug67856.phpt b/Zend/tests/bug67856.phpt new file mode 100644 index 0000000000..e867c8f37c --- /dev/null +++ b/Zend/tests/bug67856.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #67856 (Leak when using array_reduce with by-ref function) +--FILE-- +<?php +$array = [1, 2, 3]; +var_dump(array_reduce($array, function(&$a, &$b) { + return $a + $b; +}, 0)); +?> +--EXPECT-- +int(6) diff --git a/ext/standard/array.c b/ext/standard/array.c index a177ee7e0f..b503162b86 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -4298,14 +4298,18 @@ PHP_FUNCTION(array_reduce) fci.no_separation = 0; ZEND_HASH_FOREACH_VAL(htbl, operand) { - ZVAL_COPY_VALUE(&args[0], &result); - ZVAL_COPY_VALUE(&args[1], operand); + ZVAL_COPY(&args[0], &result); + ZVAL_COPY(&args[1], operand); fci.params = args; if (zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS && Z_TYPE(retval) != IS_UNDEF) { + zval_ptr_dtor(&args[1]); + zval_ptr_dtor(&args[0]); zval_ptr_dtor(&result); ZVAL_COPY_VALUE(&result, &retval); } else { + zval_ptr_dtor(&args[1]); + zval_ptr_dtor(&args[0]); php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the reduction callback"); return; } |