Correctly destroy reference in ArrayObject sort

nikic · nikic · commit 5fc71c7dba0f · 2019-04-15T13:21:45.000+02:00
The reference may be captured in an exception backtrace, in which
case the refcount may be more than one.
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
@@ -1470,7 +1470,8 @@ static void spl_array_method(INTERNAL_FUNCTION_PARAMETERS, char *fname, int fnam
 		} else {
 			GC_DELREF(aht);
 		}
-		efree(Z_REF(params[0]));
+		ZVAL_NULL(Z_REFVAL(params[0]));
+		zval_ptr_dtor(&params[0]);
 		zend_string_free(Z_STR(function_name));
 	}
 } /* }}} */

Original file line number	Diff line number	Diff line change
`@@ -1470,7 +1470,8 @@ static void spl_array_method(INTERNAL_FUNCTION_PARAMETERS, char *fname, int fnam`
`1470`	`1470`	`} else {`
`1471`	`1471`	`GC_DELREF(aht);`
`1472`	`1472`	`}`
`1473`		`- efree(Z_REF(params[0]));`
	`1473`	`+ ZVAL_NULL(Z_REFVAL(params[0]));`
	`1474`	`+ zval_ptr_dtor(&params[0]);`
`1474`	`1475`	`zend_string_free(Z_STR(function_name));`
`1475`	`1476`	`}`
`1476`	`1477`	`} /* }}} */`