Skip to content

Commit a2bbd8f

Browse files
committed
Fix leak in typed reference assignment
We're only creating tmp here to compare against the existing coerced_value. We need to destroy it in all cases.
1 parent e701146 commit a2bbd8f

File tree

2 files changed

+23
-0
lines changed

2 files changed

+23
-0
lines changed
Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
Do not leak when assigning to reference set with multiple typed properties with type coercion
3+
--FILE--
4+
<?php
5+
6+
class Test {
7+
public string $x;
8+
public string $y;
9+
}
10+
11+
$test = new Test;
12+
$ref = "";
13+
$test->x =& $ref;
14+
$test->y =& $ref;
15+
$val = 42;
16+
$ref = $val;
17+
var_dump($ref, $val);
18+
19+
?>
20+
--EXPECT--
21+
string(2) "42"
22+
int(42)

Zend/zend_execute.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3133,6 +3133,7 @@ ZEND_API zend_bool ZEND_FASTCALL zend_verify_ref_assignable_zval(zend_reference
31333133
zval_ptr_dtor(&tmp);
31343134
goto conflicting_coercion_error;
31353135
}
3136+
zval_ptr_dtor(&tmp);
31363137
}
31373138
} else {
31383139
if (!first_prop) {

0 commit comments

Comments
 (0)