From df08d6bffe0faaa76bfcccac8869c0731ef8bd70 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 18 Dec 2019 17:18:10 +0100
Subject: [PATCH] Fix leak in assign_ref with function

As far as I can see, the retval copying is already done in all
callers of this function, so it should not be duplicated here.
---
 Zend/tests/assign_ref_func_leak.phpt | 23 +++++++++++++++++++++++
 Zend/zend_execute.c                  |  3 ---
 2 files changed, 23 insertions(+), 3 deletions(-)
 create mode 100644 Zend/tests/assign_ref_func_leak.phpt

diff --git a/Zend/tests/assign_ref_func_leak.phpt b/Zend/tests/assign_ref_func_leak.phpt
new file mode 100644
index 00000000000..fe4c8017b63
--- /dev/null
+++ b/Zend/tests/assign_ref_func_leak.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Assigning the result of a non-reference function by-reference should not leak
+--FILE--
+<?php
+
+function func() {
+    return [0];
+}
+
+$x = $y =& func();
+var_dump($x, $y);
+
+?>
+--EXPECTF--
+Notice: Only variables should be assigned by reference in %s on line %d
+array(1) {
+  [0]=>
+  int(0)
+}
+array(1) {
+  [0]=>
+  int(0)
+}
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index c1ff85bff86..3b980e87763 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -596,9 +596,6 @@ static zend_never_inline ZEND_COLD int zend_wrong_assign_to_variable_reference(z
 	Z_TRY_ADDREF_P(value_ptr);
 	value_ptr = zend_assign_to_variable(variable_ptr, value_ptr, IS_TMP_VAR, EX_USES_STRICT_TYPES());
 
-	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-		ZVAL_COPY(EX_VAR(opline->result.var), value_ptr);
-	}
 	return 1;
 }