Fixed memory leak

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 856c94a22b4285637b17260f6249b0b065652354..325b242122eb4c985c4a000a8241160f78cd0ea5 100644 (file)
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -371,6 +371,7 @@ php_sprintf_getnumber(char *buffer, int *pos)
 static zend_string *
 php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 {
+       zval *newargs = NULL;
        zval *args, *z_format;
        int argc, size = 240, inpos = 0, outpos = 0, temppos;
        int alignment, currarg, adjusting, argnum, width, precision;
@@ -390,7 +391,7 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
        
        if (use_array) {
                int i = 1;
-               zval *newargs, *zv;
+               zval *zv;
                zval array;
 
                z_format = &args[format_offset];
@@ -448,6 +449,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 
                                        if (argnum <= 0) {
                                                efree(result);
+                                               if (newargs) {
+                                                       efree(newargs);
+                                               }
                                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument number must be greater than zero");
                                                return NULL;
                                        }
@@ -488,6 +492,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
                                        PRINTF_DEBUG(("sprintf: getting width\n"));
                                        if ((width = php_sprintf_getnumber(format, &inpos)) < 0) {
                                                efree(result);
+                                               if (newargs) {
+                                                       efree(newargs);
+                                               }
                                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Width must be greater than zero and less than %d", INT_MAX);
                                                return NULL;
                                        }
@@ -504,6 +511,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
                                        if (isdigit((int)format[inpos])) {
                                                if ((precision = php_sprintf_getnumber(format, &inpos)) < 0) {
                                                        efree(result);
+                                                       if (newargs) {
+                                                               efree(newargs);
+                                                       }
                                                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX);
                                                        return NULL;
                                                }
@@ -523,6 +533,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 
                        if (argnum >= argc) {
                                efree(result);
+                               if (newargs) {
+                                       efree(newargs);
+                               }
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
                                return NULL;
                        }
@@ -643,6 +656,10 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
                }
        }
        
+       if (newargs) {
+               efree(newargs);
+       }
+
        /* possibly, we have to make sure we have room for the terminating null? */
        result->val[outpos]=0;
        result->len = outpos;