archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.3' into PHP-7.4

Browse source
This commit is contained in:
Nikita Popov 2019-09-26 13:47:41 +02:00
commit d71f859a56
2 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Zend/tests/pow_array_leak.phpt Normal file
View file

@ -0,0 +1,17 @@
--TEST--
Memory leak on ** with result==op1 array
--FILE--
<?php
$x = [0];
$x **= 1;
var_dump($x);
$x = [0];
$x **= $x;
var_dump($x);
?>
--EXPECT--
int(0)
int(0)

9
Zend/zend_operators.c
View file

@ -1224,12 +1224,18 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
if (EXPECTED(op1 != op2)) {
if (Z_TYPE_P(op1) == IS_ARRAY) {
if (op1 == result) {
zval_ptr_dtor(result);
}
ZVAL_LONG(result, 0);
return SUCCESS;
} else {
op1 = zendi_convert_scalar_to_number(op1, &op1_copy, result, 0);
}
if (Z_TYPE_P(op2) == IS_ARRAY) {
if (op1 == result) {
zval_ptr_dtor(result);
}
ZVAL_LONG(result, 1L);
return SUCCESS;
} else {
@ -1237,6 +1243,9 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
}
} else {
if (Z_TYPE_P(op1) == IS_ARRAY) {
if (op1 == result) {
zval_ptr_dtor(result);
}
ZVAL_LONG(result, 0);
return SUCCESS;
} else {