archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix memory leaks in array_any() / array_all()

Browse source 
The return value is overwritten, but if the key was not an interned
string we should destroy it.

Closes GH-17977.
This commit is contained in:
Niels Dossche 2025-03-05 18:40:22 +01:00
parent eebc7b0a7a
commit 83722a5fdc
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
1 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
ext/standard/array.c
View file

@ -6629,6 +6629,11 @@ static zend_result php_array_find(const HashTable *array, zend_fcall_info fci, z
zend_result result = zend_call_function(&fci, &fci_cache); zend_result result = zend_call_function(&fci, &fci_cache);
ZEND_ASSERT(result == SUCCESS); ZEND_ASSERT(result == SUCCESS);
<<<<<<< HEAD
=======
if (EXPECTED(!Z_ISUNDEF(retval))) {
int retval_true;
>>>>>>> 2701b97011 (Fix memory leaks in array_any() / array_all())
if (UNEXPECTED(EG(exception))) { if (UNEXPECTED(EG(exception))) {
return FAILURE; return FAILURE;
@ -6637,6 +6642,7 @@ static zend_result php_array_find(const HashTable *array, zend_fcall_info fci, z
bool retval_true = zend_is_true(&retval); bool retval_true = zend_is_true(&retval);
zval_ptr_dtor(&retval); zval_ptr_dtor(&retval);
<<<<<<< HEAD
/* This negates the condition, if negate_condition is true. Otherwise it does nothing with `retval_true`. */ /* This negates the condition, if negate_condition is true. Otherwise it does nothing with `retval_true`. */
retval_true ^= negate_condition; retval_true ^= negate_condition;
@ -6650,6 +6656,10 @@ static zend_result php_array_find(const HashTable *array, zend_fcall_info fci, z
} }
break; break;
=======
if (UNEXPECTED(Z_ISUNDEF(retval))) {
return FAILURE;
>>>>>>> 2701b97011 (Fix memory leaks in array_any() / array_all())
} }
} ZEND_HASH_FOREACH_END(); } ZEND_HASH_FOREACH_END();
@ -6717,7 +6727,11 @@ PHP_FUNCTION(array_any)
RETURN_THROWS(); RETURN_THROWS();
} }
RETURN_BOOL(Z_TYPE_P(return_value) != IS_UNDEF); bool retval = !Z_ISUNDEF_P(return_value);
if (Z_TYPE_P(return_value) == IS_STRING) {
zval_ptr_dtor_str(return_value);
}
RETURN_BOOL(retval);
} }
/* }}} */ /* }}} */
@ -6737,7 +6751,11 @@ PHP_FUNCTION(array_all)
RETURN_THROWS(); RETURN_THROWS();
} }
RETURN_BOOL(Z_TYPE_P(return_value) == IS_UNDEF); bool retval = Z_ISUNDEF_P(return_value);
if (Z_TYPE_P(return_value) == IS_STRING) {
zval_ptr_dtor_str(return_value);
}
RETURN_BOOL(retval);
} }
/* }}} */ /* }}} */