MF51:

fix leak in zend_strtod() on big doubles
add new test

diff --git a/Zend/tests/zend_strtod.phpt b/Zend/tests/zend_strtod.phpt
new file mode 100644 (file)
index 0000000..32d1c0a
--- /dev/null
+++ b/Zend/tests/zend_strtod.phpt
@@ -0,0 +1,17 @@
+--TEST--
+zend_strtod() leaks on big doubles
+--FILE--
+<?php
+var_dump("1139932690.21688500" - "1139932790.21688500");
+var_dump("1139932690000.21688500" - "331139932790.21688500");
+var_dump("339932690.21688500" - "4564645646456463461139932790.21688500");
+var_dump("123123139932690.21688500" - "11399327900000000.21688500");
+
+echo "Done\n";
+?>
+--EXPECTF--    
+float(-100)
+float(808792757210)
+float(-4.5646456464565E+27)
+float(-11276204760067000)
+Done

diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
index 1810c5bf2743f67c06a728848afab668181eaa18..3a50af29c82137e4eed5a94626851d2e63491f94 100644 (file)
--- a/Zend/zend_strtod.c
+++ b/Zend/zend_strtod.c
@@ -1252,7 +1252,7 @@ zend_strtod
        _double rv, rv0;
        Long L;
        ULong y, z;
-       Bigint *bb, *bb1, *bd, *bd0, *bs, *delta;
+       Bigint *bb, *bb1, *bd, *bd0, *bs, *delta, *tmp;
        double result;
 
        CONST char decimal_point = '.';
@@ -1778,6 +1778,22 @@ zend_strtod
        if (se)
                *se = (char *)s;
        result = sign ? -value(rv) : value(rv);
+               
+       for (i = 0; i <= Kmax; i++) {
+               Bigint **listp = &freelist[i];
+               while ((tmp = *listp) != NULL) {
+                       *listp = tmp->next;
+                       free(tmp);
+               }
+               freelist[i] = NULL;
+       }
+       
+       while (p5s) {
+               tmp = p5s;
+               p5s = p5s->next;
+               free(tmp);
+       }
+       
        return result;
        }