fix bug #29975 (memory leaks when set_error_handler() is used inside error handler)

diff --git a/Zend/zend.c b/Zend/zend.c
index 2b5c03679daa9193afc556c7ee3d005d1a8896fc..4371a94f75198350e80c4b42e0b4ab11e81cc15d 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -990,7 +990,12 @@ ZEND_API void zend_error(int type, const char *format, ...)
                                zend_error_cb(type, error_filename, error_lineno, format, args);
                        }
 
-                       EG(user_error_handler) = orig_user_error_handler;
+                       if (!EG(user_error_handler)) {
+                               EG(user_error_handler) = orig_user_error_handler;
+                       } 
+                       else {
+                               zval_ptr_dtor(&orig_user_error_handler);
+                       }
 
                        efree(params);
                        zval_ptr_dtor(&z_error_message);