php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 08:12:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.2' into PHP-7.3

Browse Source
This commit is contained in:
Nikita Popov
2019-09-26 13:47:19 +02:00
parent 99c67804d5 ab938d7bbc
commit 91c4abcfcc
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
Zend/tests/pow_array_leak.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
Memory leak on ** with result==op1 array
--FILE--
<?php
$x = [0];
$x **= 1;
var_dump($x);
$x = [0];
$x **= $x;
var_dump($x);
?>
--EXPECT--
int(0)
int(0)

9
Zend/zend_operators.c
View File

@@ -1193,12 +1193,18 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
if (EXPECTED(op1 != op2)) {
if (Z_TYPE_P(op1) == IS_ARRAY) {
if (op1 == result) {
zval_ptr_dtor(result);
}
ZVAL_LONG(result, 0);
return SUCCESS;
} else {
op1 = zendi_convert_scalar_to_number(op1, &op1_copy, result, 0);
}
if (Z_TYPE_P(op2) == IS_ARRAY) {
if (op1 == result) {
zval_ptr_dtor(result);
}
ZVAL_LONG(result, 1L);
return SUCCESS;
} else {
@@ -1206,6 +1212,9 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
}
} else {
if (Z_TYPE_P(op1) == IS_ARRAY) {
if (op1 == result) {
zval_ptr_dtor(result);
}
ZVAL_LONG(result, 0);
return SUCCESS;
} else {