Skip to content

Commit feefda4

Browse files
committed
Fix GH-11878: SQLite3 callback functions cause a memory leak with a callable array
In this test file, the free_obj handler is called with a refcount of 2, caused by the fact it participates in a cycle and we do a GC_ADDREF() to increase its refcount. We never decrease its refcount so it never becomes 0 causing a memory leak. This happens in shutdown. Whether it is actually useful to check the refcount afterwards is up for debate.
1 parent ca5d482 commit feefda4

File tree

2 files changed

+27
-0
lines changed

2 files changed

+27
-0
lines changed

Zend/zend_objects_API.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,9 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_free_object_storage(zend_objects_
107107
if (obj->handlers->free_obj != zend_object_std_dtor) {
108108
GC_ADDREF(obj);
109109
obj->handlers->free_obj(obj);
110+
if (!GC_DELREF(obj)) {
111+
zend_objects_store_del(obj);
112+
}
110113
}
111114
}
112115
}
@@ -120,6 +123,9 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_free_object_storage(zend_objects_
120123
GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
121124
GC_ADDREF(obj);
122125
obj->handlers->free_obj(obj);
126+
if (!GC_DELREF(obj)) {
127+
zend_objects_store_del(obj);
128+
}
123129
}
124130
}
125131
} while (obj_ptr != end);

ext/sqlite3/tests/gh11878.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
GH-11878 (SQLite3 callback functions cause a memory leak with a callable array)
3+
--EXTENSIONS--
4+
sqlite3
5+
--FILE--
6+
<?php
7+
class Foo {
8+
public $sqlite;
9+
public function __construct() {
10+
$this->sqlite = new SQLite3(":memory:");
11+
$this->sqlite->createAggregate("indexes", array($this, "SQLiteIndex"), array($this, "SQLiteFinal"), 9);
12+
}
13+
public function SQLiteIndex() {}
14+
public function SQLiteFinal() {}
15+
}
16+
17+
$x = new Foo;
18+
?>
19+
Done
20+
--EXPECT--
21+
Done

0 commit comments

Comments
 (0)