Fixed memory leak in case of exception in iterator callbacks in 'foreach(new Iterator...

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index ed521c9c72466b85b7ed1725cd40d64f063646db..cbf2f1fb61b15440d1491eec5656805c3247e330 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3091,6 +3091,11 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
                        if (EG(exception)) {
                                array_ptr->refcount--;
                                zval_ptr_dtor(&array_ptr);
+                               if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+                                       FREE_OP1_VAR_PTR();
+                               } else {
+                                       FREE_OP1_IF_VAR();
+                               }
                                ZEND_VM_NEXT_OPCODE();
                        }
                }
@@ -3098,6 +3103,11 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
                if (EG(exception)) {
                        array_ptr->refcount--;
                        zval_ptr_dtor(&array_ptr);
+                       if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+                               FREE_OP1_VAR_PTR();
+                       } else {
+                               FREE_OP1_IF_VAR();
+                       }
                        ZEND_VM_NEXT_OPCODE();
                }
                iter->index = -1; /* will be set to 0 before using next handler */

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 02582bdb003052bcdb55701211145de7e840a692..f752cd7efd69ac91fbfe2743b9e6786f28c127d2 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2163,6 +2163,11 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        if (EG(exception)) {
                                array_ptr->refcount--;
                                zval_ptr_dtor(&array_ptr);
+                               if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+                               } else {
+
+                               }
                                ZEND_VM_NEXT_OPCODE();
                        }
                }
@@ -2170,6 +2175,11 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                if (EG(exception)) {
                        array_ptr->refcount--;
                        zval_ptr_dtor(&array_ptr);
+                       if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+                       } else {
+
+                       }
                        ZEND_VM_NEXT_OPCODE();
                }
                iter->index = -1; /* will be set to 0 before using next handler */
@@ -4663,6 +4673,11 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        if (EG(exception)) {
                                array_ptr->refcount--;
                                zval_ptr_dtor(&array_ptr);
+                               if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+                               } else {
+
+                               }
                                ZEND_VM_NEXT_OPCODE();
                        }
                }
@@ -4670,6 +4685,11 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                if (EG(exception)) {
                        array_ptr->refcount--;
                        zval_ptr_dtor(&array_ptr);
+                       if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+                       } else {
+
+                       }
                        ZEND_VM_NEXT_OPCODE();
                }
                iter->index = -1; /* will be set to 0 before using next handler */
@@ -7745,6 +7765,11 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        if (EG(exception)) {
                                array_ptr->refcount--;
                                zval_ptr_dtor(&array_ptr);
+                               if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+                                       if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+                               } else {
+                                       if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+                               }
                                ZEND_VM_NEXT_OPCODE();
                        }
                }
@@ -7752,6 +7777,11 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                if (EG(exception)) {
                        array_ptr->refcount--;
                        zval_ptr_dtor(&array_ptr);
+                       if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+                               if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+                       } else {
+                               if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+                       }
                        ZEND_VM_NEXT_OPCODE();
                }
                iter->index = -1; /* will be set to 0 before using next handler */
@@ -19983,6 +20013,11 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        if (EG(exception)) {
                                array_ptr->refcount--;
                                zval_ptr_dtor(&array_ptr);
+                               if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+                               } else {
+
+                               }
                                ZEND_VM_NEXT_OPCODE();
                        }
                }
@@ -19990,6 +20025,11 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                if (EG(exception)) {
                        array_ptr->refcount--;
                        zval_ptr_dtor(&array_ptr);
+                       if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+                       } else {
+
+                       }
                        ZEND_VM_NEXT_OPCODE();
                }
                iter->index = -1; /* will be set to 0 before using next handler */