From c578917e306b452493fed4a0aa2ecbd3a8c3f252 Mon Sep 17 00:00:00 2001 From: Xinchen Hui Date: Sun, 12 Feb 2012 04:59:08 +0000 Subject: [PATCH] Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX) --- NEWS | 4 ++++ ext/standard/array.c | 8 ++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index 3e269e80840e7..e4f484e52d2cd 100644 --- a/NEWS +++ b/NEWS @@ -45,6 +45,10 @@ PHP NEWS . Fixed bug #60968 (Late static binding doesn't work with ReflectionMethod::invokeArgs()). (Laruence) +- Array: + . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX). + (Laruence) + ?? ??? 2012, PHP 5.3.10 (to be added) diff --git a/ext/standard/array.c b/ext/standard/array.c index 060d665195048..3ca1a69a5e9d4 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -1558,11 +1558,15 @@ PHP_FUNCTION(array_fill) num--; zval_add_ref(&val); - zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL); + if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) { + zval_ptr_dtor(&val); + } while (num--) { zval_add_ref(&val); - zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL); + if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) { + zval_ptr_dtor(&val); + } } } /* }}} */