diff --git a/Zend/tests/bug80049.phpt b/Zend/tests/bug80049.phpt new file mode 100644 index 00000000000..852b71feaab --- /dev/null +++ b/Zend/tests/bug80049.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #80049: Memleak when coercing integers to string via variadic argument +--FILE-- + +--EXPECT-- +array(1) { + [0]=> + string(3) "123" +} diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index b083ad627ba..6138ecb2632 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -5463,6 +5463,7 @@ ZEND_VM_HANDLER(164, ZEND_RECV_VARIADIC, NUM, UNUSED, CACHE_SLOT) ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(params)) { zval *param = EX_VAR_NUM(EX(func)->op_array.last_var + EX(func)->op_array.T); if (UNEXPECTED(ZEND_TYPE_IS_SET(arg_info->type))) { + ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS); do { if (UNEXPECTED(!zend_verify_variadic_arg_type(EX(func), arg_info, arg_num, param, CACHE_ADDR(opline->extended_value)))) { ZEND_HASH_FILL_FINISH(); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index bacac7d0517..dbbacebe0d1 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -3907,6 +3907,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_RECV_VARIADIC_SPEC_UNUSED_HAND ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(params)) { zval *param = EX_VAR_NUM(EX(func)->op_array.last_var + EX(func)->op_array.T); if (UNEXPECTED(ZEND_TYPE_IS_SET(arg_info->type))) { + ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS); do { if (UNEXPECTED(!zend_verify_variadic_arg_type(EX(func), arg_info, arg_num, param, CACHE_ADDR(opline->extended_value)))) { ZEND_HASH_FILL_FINISH();