diff --git a/NEWS b/NEWS index b1f7dbf8e30..1f2eea02530 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,9 @@ PHP NEWS . Fixed bug GH-17913 (ReflectionFunction::isDeprecated() returns incorrect results for closures created from magic __call()). (timwolla) +- Standard: + . Fix memory leaks in array_any() / array_all(). (nielsdos) + - Treewide: . Fixed bug GH-17736 (Assertion failure zend_reference_destroy()). (nielsdos) diff --git a/ext/standard/array.c b/ext/standard/array.c index 6bfc0dc9c04..0c2de2a98a1 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -6628,7 +6628,8 @@ static zend_result php_array_find(const HashTable *array, zend_fcall_info fci, z ZVAL_COPY(&args[0], operand); zend_result result = zend_call_function(&fci, &fci_cache); - if (EXPECTED(result == SUCCESS)) { + ZEND_ASSERT(result == SUCCESS); + if (EXPECTED(!Z_ISUNDEF(retval))) { int retval_true; retval_true = zend_is_true(&retval); @@ -6656,7 +6657,7 @@ static zend_result php_array_find(const HashTable *array, zend_fcall_info fci, z zval_ptr_dtor(&args[0]); zval_ptr_dtor(&args[1]); - if (UNEXPECTED(result != SUCCESS)) { + if (UNEXPECTED(Z_ISUNDEF(retval))) { return FAILURE; } } ZEND_HASH_FOREACH_END(); @@ -6725,7 +6726,11 @@ PHP_FUNCTION(array_any) RETURN_THROWS(); } - RETURN_BOOL(Z_TYPE_P(return_value) != IS_UNDEF); + bool retval = !Z_ISUNDEF_P(return_value); + if (Z_TYPE_P(return_value) == IS_STRING) { + zval_ptr_dtor_str(return_value); + } + RETURN_BOOL(retval); } /* }}} */ @@ -6745,7 +6750,11 @@ PHP_FUNCTION(array_all) RETURN_THROWS(); } - RETURN_BOOL(Z_TYPE_P(return_value) == IS_UNDEF); + bool retval = Z_ISUNDEF_P(return_value); + if (Z_TYPE_P(return_value) == IS_STRING) { + zval_ptr_dtor_str(return_value); + } + RETURN_BOOL(retval); } /* }}} */ diff --git a/ext/standard/tests/array/gh17977.phpt b/ext/standard/tests/array/gh17977.phpt new file mode 100644 index 00000000000..4a4f344dc47 --- /dev/null +++ b/ext/standard/tests/array/gh17977.phpt @@ -0,0 +1,18 @@ +--TEST-- +array_any() / array_all() leak +--DESCRIPTION-- +Found in GH-16831#issuecomment-2700410631 +--FILE-- + 1], static fn () => true)); +var_dump(array_all([$key => 1], static fn () => false)); + +?> +--EXPECT-- +bool(true) +bool(false)