Fixed bug #63726 (Memleak with static properties and internal/user classes)

laruence · laruence · commit ad553a7af237 · 2012-12-10T20:28:27.000+08:00
diff --git a/NEWS b/NEWS
@@ -7,6 +7,8 @@ PHP                                                                        NEWS
 #### ADD NEWS TO 5.3.21 ONLY ####
 
 - Zend Engine:
+  . Fixed bug #63726 (Memleak with static properties and internal/user
+    classes). (Laruence)
   . Fixed bug #63635 (Segfault in gc_collect_cycles). (Dmitry)
   . Fixed bug #63512 (parse_ini_file() with INI_SCANNER_RAW removes quotes 
     from value). (Pierrick)
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
@@ -3472,6 +3472,8 @@ ZEND_API int zend_update_static_property(zend_class_entry *scope, char *name, in
 				(*property)->value = value->value;
 				if (Z_REFCOUNT_P(value) > 0) {
 					zval_copy_ctor(*property);
+				} else {
+					efree(value);
 				}
 			} else {
 				zval *garbage = *property;
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
@@ -437,6 +437,8 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM
 				(*variable_ptr)->value = value->value;
 				if (Z_REFCOUNT_P(value) > 0) {
 					zval_copy_ctor(*variable_ptr);
+				} else {
+					efree(value);
 				}
 				zval_dtor(&garbage);
 			} else {

Original file line number	Diff line number	Diff line change
`@@ -3472,6 +3472,8 @@ ZEND_API int zend_update_static_property(zend_class_entry scope, char name, in`
`3472`	`3472`	`(*property)->value = value->value;`
`3473`	`3473`	`if (Z_REFCOUNT_P(value) > 0) {`
`3474`	`3474`	`zval_copy_ctor(*property);`
	`3475`	`+ } else {`
	`3476`	`+ efree(value);`
`3475`	`3477`	`}`
`3476`	`3478`	`} else {`
`3477`	`3479`	`zval garbage = property;`
Original file line number	Diff line number	Diff line change
`@@ -437,6 +437,8 @@ static void zend_std_write_property(zval object, zval member, zval *value TSRM`
`437`	`437`	`(*variable_ptr)->value = value->value;`
`438`	`438`	`if (Z_REFCOUNT_P(value) > 0) {`
`439`	`439`	`zval_copy_ctor(*variable_ptr);`
	`440`	`+ } else {`
	`441`	`+ efree(value);`
`440`	`442`	`}`
`441`	`443`	`zval_dtor(&garbage);`
`442`	`444`	`} else {`