Fixed bug #37707 clone without assigning leaks memory

# Based on a patch by Nuno

diff --git a/Zend/tests/bug37707.phpt b/Zend/tests/bug37707.phpt
new file mode 100755 (executable)
index 0000000..3657fec
--- /dev/null
+++ b/Zend/tests/bug37707.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #37707 (clone without assigning leaks memory)
+--FILE--
+<?php
+class testme {}
+clone new testme();
+echo "NO LEAK\n";
+?>
+--EXPECT--
+NO LEAK
+

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index fe07011bf0f0bd2bda0df39cb239353e06f115dd..c9d93dbe2c2ce835b6d2c80c42e76d963653d2e5 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2506,11 +2506,9 @@ ZEND_VM_HANDLER(110, ZEND_CLONE, CONST|TMP|VAR|UNUSED|CV, ANY)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index bf496aca1939e664acf7f65f69b3a96315bedea4..7c8e6cc16248c28331e07c83d51ac75eda260c2f 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1831,11 +1831,9 @@ static int ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -4285,11 +4283,9 @@ static int ZEND_CLONE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -7321,11 +7317,9 @@ static int ZEND_CLONE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -14166,11 +14160,9 @@ static int ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;
@@ -19451,11 +19443,9 @@ static int ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
 
        EX_T(opline->result.u.var).var.ptr_ptr = &EX_T(opline->result.u.var).var.ptr;
-       ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
-       if (EG(exception)) {
-               FREE_ZVAL(EX_T(opline->result.u.var).var.ptr);
-       } else {
+       if (!EG(exception) && RETURN_VALUE_USED(opline)) {
+               ALLOC_ZVAL(EX_T(opline->result.u.var).var.ptr);
+               Z_OBJVAL_P(EX_T(opline->result.u.var).var.ptr) = clone_call(obj TSRMLS_CC);
                Z_TYPE_P(EX_T(opline->result.u.var).var.ptr) = IS_OBJECT;
                EX_T(opline->result.u.var).var.ptr->refcount=1;
                EX_T(opline->result.u.var).var.ptr->is_ref=1;