Fix leak in typed reference assignment

We're only creating tmp here to compare against the existing
coerced_value. We need to destroy it in all cases.

diff --git a/Zend/tests/type_declarations/typed_properties_reference_coercion_leak.phpt b/Zend/tests/type_declarations/typed_properties_reference_coercion_leak.phpt
new file mode 100644 (file)
index 0000000..57d09be
--- /dev/null
+++ b/Zend/tests/type_declarations/typed_properties_reference_coercion_leak.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Do not leak when assigning to reference set with multiple typed properties with type coercion
+--FILE--
+<?php
+
+class Test {
+    public string $x;
+    public string $y;
+}
+
+$test = new Test;
+$ref = "";
+$test->x =& $ref;
+$test->y =& $ref;
+$val = 42;
+$ref = $val;
+var_dump($ref, $val);
+
+?>
+--EXPECT--
+string(2) "42"
+int(42)

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 601b5221eef2cf6667f10f359940b644db3e72b9..bdcb2ce1759eaedf6aaf7be8c4ad5dcb9735a88a 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -3133,6 +3133,7 @@ type_error:
                                        zval_ptr_dtor(&tmp);
                                        goto conflicting_coercion_error;
                                }
+                               zval_ptr_dtor(&tmp);
                        }
                } else {
                        if (!first_prop) {