Fix bug #67858: Leak when $php_errormsg already set

diff --git a/Zend/tests/bug67858.phpt b/Zend/tests/bug67858.phpt
new file mode 100644 (file)
index 0000000..f0cfc74
--- /dev/null
+++ b/Zend/tests/bug67858.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #67858: Leak when $php_errormsg already set
+--INI--
+track_errors=1
+error_reporting=E_ALL
+--FILE--
+<?php
+
+function f() {
+    $php_errormsg = [1, 2, 3];
+    echo $var;
+    var_dump($php_errormsg);
+}
+f();
+
+?>
+--EXPECTF--
+Notice: Undefined variable: var in %s on line %d
+string(23) "Undefined variable: var"

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 8af877215c1b0a80d2d7482dee5383bdb43aac9f..b45a0216500ee256efcefc5cd8fdcaf82693a96b 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -1724,6 +1724,7 @@ ZEND_API int zend_set_local_var_str(const char *name, int len, zval *value, int
                                if (op_array->vars[i]->h == h &&
                                    op_array->vars[i]->len == len &&
                                    memcmp(op_array->vars[i]->val, name, len) == 0) {
+                                       zval_ptr_dtor(EX_VAR_NUM(i));
                                        ZVAL_COPY_VALUE(EX_VAR_NUM(i), value);
                                        return SUCCESS;
                                }