Fixed bug #27598 (list() array key assignment causes HUGE memory leak)

diff --git a/Zend/tests/bug27598.phpt b/Zend/tests/bug27598.phpt
new file mode 100755 (executable)
index 0000000..534e8cf
--- /dev/null
+++ b/Zend/tests/bug27598.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #27598 (list() array key assignment causes HUGE memory leak)
+--FILE--
+<?php
+list($out[0]) = array(1);
+var_dump($out);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index cfc1a59ef15498c2d76263e7ffedac4c8eca75db..d2afe43b6bd1a150b8a13d6f4cfe983863d83bbd 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3102,7 +3102,6 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
        zend_llist_element *dimension;
        zend_op *opline;
        znode last_container;
-       int opcode_index;
        int last_op_number;
        zend_op *last_op;
 
@@ -3145,14 +3144,10 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
                ((list_llist_element *) le->data)->value = last_container;
                zend_llist_destroy(&((list_llist_element *) le->data)->dimensions);
                zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
-               opcode_index = - 1;
                last_op_number = get_next_op_number(CG(active_op_array))-1;
                last_op = &CG(active_op_array)->opcodes[last_op_number];
-               if (last_op->opcode == ZEND_FETCH_OBJ_W) {
-                       opcode_index = - 2;
-               }
                zend_do_assign(result, &((list_llist_element *) le->data)->var, &((list_llist_element *) le->data)->value TSRMLS_CC);
-               CG(active_op_array)->opcodes[CG(active_op_array)->last + opcode_index].result.u.EA.type |= EXT_TYPE_UNUSED;
+               zend_do_free(result TSRMLS_CC);
                le = le->next;
        }
        zend_llist_destroy(&CG(dimension_llist));