Fix bug #67433 SIGSEGV when using count() on an object implementing Countable

diff --git a/NEWS b/NEWS
index 490ccea7a674cc491439785c54b571bbd998bba4..38a05790dfa82e3fc0e26af90b4d6069c13a8e65 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
   . Fixed bug #67392 (dtrace breaks argument unpack). (Nikita)
   . Fixed bug #67428 (header('Location: foo') will override a 308-399 response
     code). (Adam)
+  . Fixed bug #67433 (SIGSEGV when using count() on an object implementing
+    Countable). (Matteo)
 
 - CLI server:
   . Implemented FR #67429 (CLI server is missing some new HTTP response codes).

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4f983310353d024aec523c4ce7880d9d81867fdf..cbcaaf5b8bb8aeb43aee08b0c65ec6418cddb9aa 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -342,8 +342,7 @@ PHP_FUNCTION(count)
                                        RETVAL_LONG(Z_LVAL_P(retval));
                                        zval_ptr_dtor(&retval);
                                }
-                               zval_dtor(mode_zv);
-                               efree(mode_zv);
+                               zval_ptr_dtor(&mode_zv);
                                return;
                        }
 #endif