From 0f5bad93fd9eb0bb73855b536d15c6b6bacb6dbc Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Mon, 18 Aug 2014 21:08:50 +0400 Subject: Fixed bug #67856 (Leak when using array_reduce with by-ref function) --- ext/standard/array.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'ext/standard/array.c') diff --git a/ext/standard/array.c b/ext/standard/array.c index a177ee7e0f..b503162b86 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -4298,14 +4298,18 @@ PHP_FUNCTION(array_reduce) fci.no_separation = 0; ZEND_HASH_FOREACH_VAL(htbl, operand) { - ZVAL_COPY_VALUE(&args[0], &result); - ZVAL_COPY_VALUE(&args[1], operand); + ZVAL_COPY(&args[0], &result); + ZVAL_COPY(&args[1], operand); fci.params = args; if (zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS && Z_TYPE(retval) != IS_UNDEF) { + zval_ptr_dtor(&args[1]); + zval_ptr_dtor(&args[0]); zval_ptr_dtor(&result); ZVAL_COPY_VALUE(&result, &retval); } else { + zval_ptr_dtor(&args[1]); + zval_ptr_dtor(&args[0]); php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the reduction callback"); return; } -- cgit v1.2.1