Fixed bug #78436

diff --git a/NEWS b/NEWS
index 8fa0367077e38dc5c89799df998b7fb547c79f18..45df25766088966cc4c8d6f3944843ae7cb38645 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed bug #78441 (Parse error due to heredoc identifier followed by digit).
     (cmb)
 
+- SPL:
+  . Fixed bug #78436 (Missing addref in SplPriorityQueue EXTR_BOTH mode).
+    (Nikita)
+
 22 Aug 2019, PHP 7.4.0beta4
 
 - Core:

diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c
index 6de7adb7622fc6289ea293a2fd68239fb520456e..af0043b94b3ecbd9d4017268664ed20c90fc70a8 100644 (file)
--- a/ext/spl/spl_heap.c
+++ b/ext/spl/spl_heap.c
@@ -144,7 +144,9 @@ static void spl_pqueue_extract_helper(zval *result, zval *value, int flags) /* {
        spl_pqueue_elem *elem = Z_PTR_P(value);
        if ((flags & SPL_PQUEUE_EXTR_BOTH) == SPL_PQUEUE_EXTR_BOTH) {
                array_init(result);
+               Z_TRY_ADDREF(elem->data);
                add_assoc_zval_ex(result, "data", sizeof("data") - 1, &elem->data);
+               Z_TRY_ADDREF(elem->priority);
                add_assoc_zval_ex(result, "priority", sizeof("priority") - 1, &elem->priority);
                return;
        }

diff --git a/ext/spl/tests/bug78436.phpt b/ext/spl/tests/bug78436.phpt
new file mode 100644 (file)
index 0000000..8b978d5
--- /dev/null
+++ b/ext/spl/tests/bug78436.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Bug #78436: Missing addref in SplPriorityQueue EXTR_BOTH mode
+--FILE--
+<?php
+
+$pq = new SplPriorityQueue();
+$pq->insert(new stdClass, 1);
+var_dump($pq);
+var_dump($pq);
+
+?>
+--EXPECT--
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}