archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-17 22:48:57 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix bug #67111

Browse source 
Loop variables need to be freed for both "break" and "continue".

I'm adding the test to Zend/ because it's good to have a test for
this even without opcache.
This commit is contained in:
Nikita Popov 2014-12-19 21:40:54 +01:00
parent 5fc2fede9c
commit aa394e70ff
3 changed files with 27 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -31,6 +31,10 @@ PHP NEWS
- Mcrypt: - Mcrypt:
. Fixed possible read after end of buffer and use after free. (Dmitry) . Fixed possible read after end of buffer and use after free. (Dmitry)
- Opcache:
. Fixed bug #67111 (Memory leak when using "continue 2" inside two foreach
loops). (Nikita)
- Pcntl: - Pcntl:
. Fixed bug #60509 (pcntl_signal doesn't decrease ref-count of old handler . Fixed bug #60509 (pcntl_signal doesn't decrease ref-count of old handler
when setting SIG_DFL). (Julien) when setting SIG_DFL). (Julien)

20
Zend/tests/bug67111.phpt Normal file
View file

@ -0,0 +1,20 @@
--TEST--
Bug #67111: Memory leak when using "continue 2" inside two foreach loops
--FILE--
<?php
$array1 = [1, 2, 3];
$array2 = [1, 2, 3];
foreach ($array1 as $x) {
foreach ($array2 as $y) {
echo "$x.$y\n";
continue 2;
}
}
?>
--EXPECT--
1.1
2.1
3.1

6
ext/opcache/Optimizer/pass2.c
View file

@ -175,9 +175,9 @@ if (ZEND_OPTIMIZER_PASS_2 & OPTIMIZATION_LEVEL) {
jmp_to = &op_array->brk_cont_array[array_offset]; jmp_to = &op_array->brk_cont_array[array_offset];
array_offset = jmp_to->parent; array_offset = jmp_to->parent;
if (--nest_levels > 0) { if (--nest_levels > 0) {
if (opline->opcode == ZEND_BRK && if (op_array->opcodes[jmp_to->brk].opcode == ZEND_FREE ||
(op_array->opcodes[jmp_to->brk].opcode == ZEND_FREE || op_array->opcodes[jmp_to->brk].opcode == ZEND_SWITCH_FREE
op_array->opcodes[jmp_to->brk].opcode == ZEND_SWITCH_FREE)) { ) {
dont_optimize = 1; dont_optimize = 1;
break; break;
} }