Fix #79199: curl_copy_handle() memory leak

`curl_copy_handle()` already registers a new resource, so we must not
increase the refcount of the original resource.

diff --git a/NEWS b/NEWS
index 8fd4c708fda2e02ec667ee397252284c676285f9..32db597c9b995b9fef7f07bbbba71b9bea6051cc 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)
   . Fixed bug #78210 (Invalid pointer address). (cmb, Nikita)
 
+- CURL:
+  . Fixed bug #79199 (curl_copy_handle() memory leak). (cmb)
+
 - SimpleXML:
   . Fixed bug #61597 (SXE properties may lack attributes and content). (cmb)
 

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index f6707310f49c2586c951105882f94bb1061a5a69..630d3b0a89664ca54516cda9cdb14bdcaf99008b 100644 (file)
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -2167,8 +2167,6 @@ PHP_FUNCTION(curl_copy_handle)
 
        _php_setup_easy_copy_handlers(dupch, ch);
 
-       Z_ADDREF_P(zid);
-
        ZVAL_RES(return_value, zend_register_resource(dupch, le_curl));
        dupch->res = Z_RES_P(return_value);
 }

diff --git a/ext/curl/tests/bug79199.phpt b/ext/curl/tests/bug79199.phpt
new file mode 100644 (file)
index 0000000..b56f226
--- /dev/null
+++ b/ext/curl/tests/bug79199.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #79199 (curl_copy_handle() memory leak)
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip curl extension not available');
+?>
+--FILE--
+<?php
+$mem_old = 0;
+for($i = 0; $i < 50; ++$i) {
+    $c1 = curl_init();
+    $c2 = curl_copy_handle($c1);
+    curl_close($c2);
+    curl_close($c1);
+    $mem_new = memory_get_usage();
+    if ($mem_new <= $mem_old) {
+        break;
+    }
+    $mem_old = $mem_new;
+}
+echo $i < 50 ? "okay" : "leak", PHP_EOL;
+?>
+--EXPECT--
+okay