Fixed bug #27295 (memory leak inside sscanf()).

diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c
index 675cef897b5437a31406994516beb21d5accb20b..ba158e598c212a6a86bf8c77d5bd27c04bc5f174 100644 (file)
--- a/ext/standard/scanf.c
+++ b/ext/standard/scanf.c
@@ -933,7 +933,7 @@ PHPAPI int php_sscanf_internal(     char *string, char *format,
                                if (!(flags & SCAN_SUPPRESS)) {
                                        if (numVars) {
                                                current = args[objIndex++];
-                                               convert_to_string( *current );
+                                               zval_dtor( *current );
                                                ZVAL_STRINGL( *current, string, end-string, 1);
                                        } else {
                                                add_index_stringl(*return_value, objIndex++, string, end-string, 1);

diff --git a/ext/standard/tests/strings/bug27295.phpt b/ext/standard/tests/strings/bug27295.phpt
new file mode 100644 (file)
index 0000000..d23d270
--- /dev/null
+++ b/ext/standard/tests/strings/bug27295.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #27295 (memory leak inside sscanf())
+--FILE--
+<?php
+$strings = array("foo = bar", "bar = foo");
+foreach( $strings as $string )
+{
+       sscanf( $string, "%s = %[^[]]", $var, $val );
+       echo "$var = $val\n";
+}
+?>
+--EXPECT--
+foo = bar
+bar = foo