Fixed bug #67856 (Leak when using array_reduce with by-ref function)

diff --git a/Zend/tests/bug67856.phpt b/Zend/tests/bug67856.phpt
new file mode 100644 (file)
index 0000000..e867c8f
--- /dev/null
+++ b/Zend/tests/bug67856.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #67856 (Leak when using array_reduce with by-ref function)
+--FILE--
+<?php
+$array = [1, 2, 3];
+var_dump(array_reduce($array, function(&$a, &$b) {
+    return $a + $b;
+}, 0));
+?>
+--EXPECT--
+int(6)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index a177ee7e0f8b43df64700a96c4b844d9ea93fb3e..b503162b86d45115cc5c604dd6194a3453327c67 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4298,14 +4298,18 @@ PHP_FUNCTION(array_reduce)
        fci.no_separation = 0;
 
        ZEND_HASH_FOREACH_VAL(htbl, operand) {
-               ZVAL_COPY_VALUE(&args[0], &result);
-               ZVAL_COPY_VALUE(&args[1], operand);
+               ZVAL_COPY(&args[0], &result);
+               ZVAL_COPY(&args[1], operand);
                fci.params = args;
 
                if (zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS && Z_TYPE(retval) != IS_UNDEF) {
+                       zval_ptr_dtor(&args[1]);
+                       zval_ptr_dtor(&args[0]);
                        zval_ptr_dtor(&result);
                        ZVAL_COPY_VALUE(&result, &retval);
                } else {
+                       zval_ptr_dtor(&args[1]);
+                       zval_ptr_dtor(&args[0]);
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the reduction callback");
                        return;
                }