Skip to content

Commit

Permalink
Fix leak in typed reference assignment
Browse files Browse the repository at this point in the history
We're only creating tmp here to compare against the existing
coerced_value. We need to destroy it in all cases.
  • Loading branch information
nikic committed Aug 27, 2020
1 parent e701146 commit a2bbd8f
Show file tree
Hide file tree
Showing 2 changed files with 23 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
--TEST--
Do not leak when assigning to reference set with multiple typed properties with type coercion
--FILE--
<?php

class Test {
public string $x;
public string $y;
}

$test = new Test;
$ref = "";
$test->x =& $ref;
$test->y =& $ref;
$val = 42;
$ref = $val;
var_dump($ref, $val);

?>
--EXPECT--
string(2) "42"
int(42)
1 change: 1 addition & 0 deletions Zend/zend_execute.c
Original file line number Diff line number Diff line change
Expand Up @@ -3133,6 +3133,7 @@ ZEND_API zend_bool ZEND_FASTCALL zend_verify_ref_assignable_zval(zend_reference
zval_ptr_dtor(&tmp);
goto conflicting_coercion_error;
}
zval_ptr_dtor(&tmp);
}
} else {
if (!first_prop) {
Expand Down

0 comments on commit a2bbd8f

Please sign in to comment.