by calling php_stream_path_encode for unicode strings, php_stream_path_param_encode decrements
the refcount, but never restores it, which can cause freeing of zvals before they are done being used.
if (FAILURE == php_stream_path_encode(NULL, &path, &path_len, Z_USTRVAL_PP(ppzval), Z_USTRLEN_PP(ppzval), options, context)) {
return FAILURE;
}
+ Z_ADDREF_PP(ppzval); /* the conversion removes a refcount */
MAKE_STD_ZVAL(zpath);
ZVAL_STRINGL(zpath, path, path_len, 0);
Z_UNSET_ISREF_P(zpath);