]> granicus.if.org Git - php/commitdiff
Fixed possible memory leak in &=, |=, ^=.
authorDmitry Stogov <dmitry@zend.com>
Fri, 2 Dec 2016 09:34:46 +0000 (12:34 +0300)
committerDmitry Stogov <dmitry@zend.com>
Fri, 2 Dec 2016 09:34:46 +0000 (12:34 +0300)
Zend/tests/self_and.phpt
Zend/tests/self_or.phpt
Zend/tests/self_xor.phpt
Zend/zend_operators.c

index cdcde77992b06b51f3bdb0ebe8f5015f60c5fe9c..e9ddc849ebaa19621f9129ace74089477f4aec02 100644 (file)
@@ -6,6 +6,8 @@ ANDing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);
 
 $s &= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 &= 33;
 var_dump($s2);
 
+$s3 &= " ";
+var_dump($s3);
+
+$s4 &= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--    
 int(18)
 int(0)
 int(33)
+string(1) " "
+string(2) "  "
 Done
index ae667bff16af85ce613bed45f137ab2e62c08216..991aafa9801030a5b715a26bbc5fa4f5b0dbffd0 100644 (file)
@@ -6,6 +6,8 @@ ORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);
 
 $s |= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 |= 33;
 var_dump($s2);
 
+$s3 |= " ";
+var_dump($s3);
+
+$s4 |= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--
 int(127)
 int(11)
 int(45345)
+string(1) "f"
+string(2) "ff"
 Done
index a7e43f539d6ecef52df1429f78395eef09886f88..1577690a897a7fed729f3e530dd5dbacf94bfbf0 100644 (file)
@@ -6,6 +6,8 @@ XORing strings
 $s = "123";
 $s1 = "test";
 $s2 = "45345some";
+$s3 = str_repeat("f", 1);
+$s4 = str_repeat("f", 2);
 
 $s ^= 22;
 var_dump($s);
@@ -16,10 +18,18 @@ var_dump($s1);
 $s2 ^= 33;
 var_dump($s2);
 
+$s3 |= " ";
+var_dump($s3);
+
+$s4 |= "  ";
+var_dump($s4);
+
 echo "Done\n";
 ?>
 --EXPECTF--
 int(109)
 int(11)
 int(45312)
-Done
+string(1) "f"
+string(2) "ff"
+Done
\ No newline at end of file
index a02551b1bdd5f7f86769675a4073a30bcdfff2e7..2d7fd962792b8f5506177931797b71e24bfebe28 100644 (file)
@@ -1349,6 +1349,9 @@ ZEND_API int ZEND_FASTCALL bitwise_or_function(zval *result, zval *op1, zval *op
                if (EXPECTED(Z_STRLEN_P(op1) >= Z_STRLEN_P(op2))) {
                        if (EXPECTED(Z_STRLEN_P(op1) == Z_STRLEN_P(op2)) && Z_STRLEN_P(op1) == 1) {
                                zend_uchar or = (zend_uchar) (*Z_STRVAL_P(op1) | *Z_STRVAL_P(op2));
+                               if (result==op1) {
+                                       zend_string_release(Z_STR_P(result));
+                               }
                                if (CG(one_char_string)[or]) {
                                        ZVAL_INTERNED_STR(result, CG(one_char_string)[or]);
                                } else {
@@ -1416,6 +1419,9 @@ ZEND_API int ZEND_FASTCALL bitwise_and_function(zval *result, zval *op1, zval *o
                if (EXPECTED(Z_STRLEN_P(op1) >= Z_STRLEN_P(op2))) {
                        if (EXPECTED(Z_STRLEN_P(op1) == Z_STRLEN_P(op2)) && Z_STRLEN_P(op1) == 1) {
                                zend_uchar and = (zend_uchar) (*Z_STRVAL_P(op1) & *Z_STRVAL_P(op2));
+                               if (result==op1) {
+                                       zend_string_release(Z_STR_P(result));
+                               }
                                if (CG(one_char_string)[and]) {
                                        ZVAL_INTERNED_STR(result, CG(one_char_string)[and]);
                                } else {
@@ -1483,6 +1489,9 @@ ZEND_API int ZEND_FASTCALL bitwise_xor_function(zval *result, zval *op1, zval *o
                if (EXPECTED(Z_STRLEN_P(op1) >= Z_STRLEN_P(op2))) {
                        if (EXPECTED(Z_STRLEN_P(op1) == Z_STRLEN_P(op2)) && Z_STRLEN_P(op1) == 1) {
                                zend_uchar xor = (zend_uchar) (*Z_STRVAL_P(op1) ^ *Z_STRVAL_P(op2));
+                               if (result==op1) {
+                                       zend_string_release(Z_STR_P(result));
+                               }
                                if (CG(one_char_string)[xor]) {
                                        ZVAL_INTERNED_STR(result, CG(one_char_string)[xor]);
                                } else {