MFB: Fixed bug #37707 clone without assigning leaks memory

diff --git a/Zend/tests/bug37707.phpt b/Zend/tests/bug37707.phpt
new file mode 100755 (executable)
index 0000000..3657fec
--- /dev/null
+++ b/Zend/tests/bug37707.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #37707 (clone without assigning leaks memory)
+--FILE--
+<?php
+class testme {}
+clone new testme();
+echo "NO LEAK\n";
+?>
+--EXPECT--
+NO LEAK
+

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 0007203bfadbe3627b765252fc7b35dfce45f2f0..b7e57c7318f390646c1cee906df7006236b9ed41 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2536,11 +2536,9 @@ ZEND_VM_HANDLER(110, ZEND_CLONE, CONST|TMP|VAR|UNUSED|CV, ANY)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d957738d08a8b24f8814046cb8f020664cbb33c8..b414f747e5623f2d5e772d3893afe4623239c15b 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1781,11 +1781,9 @@ static int ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -4291,11 +4289,9 @@ static int ZEND_CLONE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -7398,11 +7394,9 @@ static int ZEND_CLONE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -14530,11 +14524,9 @@ static int ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -20039,11 +20031,9 @@ static int ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;