- Fix various memory leaks.

diff --git a/Zend/zend-parser.y b/Zend/zend-parser.y
index 1fab94d93d1581573243abb194fd3ac74a003e5d..3f12046352c0ac7af54fa87f952c2d81f1bebdb6 100644 (file)
--- a/Zend/zend-parser.y
+++ b/Zend/zend-parser.y
@@ -605,7 +605,7 @@ encaps_list:
 
 encaps_var:
                VARIABLE { do_fetch_globals(&$1); do_begin_variable_parse(CLS_C); fetch_simple_variable(&$$, &$1, 1 CLS_CC); }
-       |       VARIABLE '[' encaps_var_offset ']'      { do_fetch_globals(&$1); do_begin_variable_parse(CLS_C); fetch_array_begin(&$$, &$1, &$3 CLS_CC); }
+       |       VARIABLE '[' { do_begin_variable_parse(CLS_C); } encaps_var_offset ']'  { do_fetch_globals(&$1);  fetch_array_begin(&$$, &$1, &$4 CLS_CC); }
        |       VARIABLE ZEND_OBJECT_OPERATOR STRING { do_begin_variable_parse(CLS_C); fetch_simple_variable(&$2, &$1, 1 CLS_CC); do_fetch_property(&$$, &$2, &$3 CLS_CC); }
        |       DOLLAR_OPEN_CURLY_BRACES expr '}' { do_begin_variable_parse(CLS_C);  fetch_simple_variable(&$$, &$2, 1 CLS_CC); }
        |       DOLLAR_OPEN_CURLY_BRACES STRING '[' expr ']' '}' { do_begin_variable_parse(CLS_C);  fetch_array_begin(&$$, &$2, &$4 CLS_CC); }
@@ -616,7 +616,7 @@ encaps_var:
 encaps_var_offset:
                STRING  { $$ = $1; }
        |       NUM_STRING      { $$ = $1; }
-       |       { do_begin_variable_parse(CLS_C); } VARIABLE { fetch_simple_variable(&$$, &$2, 1 CLS_CC); }
+       |       VARIABLE { fetch_simple_variable(&$$, &$1, 1 CLS_CC); }
 ;
 
 

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 5d16f370c10c391571ba08b16cd2c5185f51700d..d1e4a9208851d6e33bb3884a31ec7188383ab8f2 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -937,12 +937,17 @@ void do_brk_cont(int op, znode *expr CLS_DC)
 void do_switch_cond(znode *cond CLS_DC)
 {
        zend_switch_entry switch_entry;
+       zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
 
        switch_entry.cond = *cond;
        switch_entry.default_case = -1;
        switch_entry.control_var = -1;
        zend_stack_push(&CG(switch_cond_stack), (void *) &switch_entry, sizeof(switch_entry));
 
+       if (opline->result.op_type == IS_VAR) {
+               opline->result.u.EA.type |= EXT_TYPE_UNUSED;
+       }
+
        do_begin_loop(CLS_C);
 
        INC_BPC(CG(active_op_array));

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index b66235f97a6b416f940c8b0629c3a3f839d5f287..cd1472a1bd34f3c3133dae636939b1fd43e1ffb7 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1552,6 +1552,9 @@ send_by_ref:
                                }
                                break;
                        case ZEND_CASE:
+                               if (opline->op1.op_type == IS_VAR) {
+                                       EG(AiCount)++;
+                               }
                                is_equal_function(&Ts[opline->result.u.var].tmp_var, 
                                                         get_zval_ptr(&opline->op1, Ts, &free_op1, BP_VAR_R),
                                                         get_zval_ptr(&opline->op2, Ts, &free_op2, BP_VAR_R) );

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index e10be7d706ada715d7fcde45b6f98a9851175a29..0b02007642df31d67ac2b98cfbc753cab4fea178 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -278,8 +278,6 @@ int call_user_function(HashTable *function_table, zval *object, zval *function_n
                return FAILURE;
        }
 
-       function_state.function_symbol_table = (HashTable *) emalloc(sizeof(HashTable));
-       zend_hash_init(function_state.function_symbol_table, 0, NULL, PVAL_PTR_DTOR, 0);
 
        for (i=0; i<param_count; i++) {
                zval *param;
@@ -293,35 +291,38 @@ int call_user_function(HashTable *function_table, zval *object, zval *function_n
                zend_ptr_stack_push(&EG(argument_stack), param);
        }
 
-       if (object) {
-               zval *dummy = (zval *) emalloc(sizeof(zval)), **this_ptr;
-
-               var_uninit(dummy);
-               dummy->refcount=1;
-               dummy->is_ref=0;
-               zend_hash_update_ptr(function_state.function_symbol_table, "this", sizeof("this"), dummy, sizeof(zval *), (void **) &this_ptr);
-               zend_assign_to_variable_reference(NULL, this_ptr, &object, NULL ELS_CC);
-       }
+       zend_ptr_stack_push(&EG(argument_stack), (void *) param_count);
 
-       calling_symbol_table = EG(active_symbol_table);
-       EG(active_symbol_table) = function_state.function_symbol_table;
        var_uninit(retval);
        if (function_state.function->type == ZEND_USER_FUNCTION) {
+               calling_symbol_table = EG(active_symbol_table);
+               EG(active_symbol_table) = (HashTable *) emalloc(sizeof(HashTable));
+               zend_hash_init(EG(active_symbol_table), 0, NULL, PVAL_PTR_DTOR, 0);
+               if (object) {
+                       zval *dummy = (zval *) emalloc(sizeof(zval)), **this_ptr;
+
+                       var_uninit(dummy);
+                       dummy->refcount=1;
+                       dummy->is_ref=0;
+                       zend_hash_update_ptr(EG(active_symbol_table), "this", sizeof("this"), dummy, sizeof(zval *), (void **) &this_ptr);
+                       zend_assign_to_variable_reference(NULL, this_ptr, &object, NULL ELS_CC);
+               }
                original_return_value = EG(return_value);
                original_op_array = EG(active_op_array);
                EG(return_value) = retval;
                EG(active_op_array) = (zend_op_array *) function_state.function;
                original_opline_ptr = EG(opline_ptr);   
                zend_execute(EG(active_op_array) ELS_CC);
+               zend_hash_destroy(EG(active_symbol_table));             
+               efree(EG(active_symbol_table));
+               EG(active_symbol_table) = calling_symbol_table;
                EG(active_op_array) = original_op_array;
                EG(return_value)=original_return_value;
                EG(opline_ptr) = original_opline_ptr;
        } else {
                ((zend_internal_function *) function_state.function)->handler(param_count, retval, &EG(regular_list), &EG(persistent_list));
        }
-       zend_hash_destroy(EG(active_symbol_table));
-       efree(EG(active_symbol_table));
-       EG(active_symbol_table) = calling_symbol_table;
+       zend_ptr_stack_clear_multiple(ELS_C);
        EG(function_state_ptr) = original_function_state_ptr;
 
        return SUCCESS;