Fix bug #27821 xml_parse segfaults when xml_set_object called from class method

fix memleaks in compat.c

diff --git a/ext/xml/compat.c b/ext/xml/compat.c
index e6590c698724aad64a3ae15d1a396579566bbb6b..396393ee51b50df795dd34c374e6fbf399abafcc 100644 (file)
--- a/ext/xml/compat.c
+++ b/ext/xml/compat.c
@@ -232,6 +232,7 @@ _comment_handler(void *user, const xmlChar *comment)
 
                _build_comment(comment, xmlStrlen(comment), &d_comment, &d_comment_len);
                parser->h_default(parser->user, d_comment, d_comment_len);
+               xmlFree(d_comment);
        }
 }
 
@@ -257,6 +258,7 @@ _get_entity(void *user, const xmlChar *name)
                
                _build_entity(name, xmlStrlen(name), &entity, &len);
                parser->h_default(parser->user, (const xmlChar *) entity, len);
+               xmlFree(entity);
        }
 
        return NULL;

diff --git a/ext/xml/xml.c b/ext/xml/xml.c
index 1f29585df07c5f9bb36524c52c63952b96ae915f..f17601f8ebb3b6575d463c86165a737ba52f042b 100644 (file)
--- a/ext/xml/xml.c
+++ b/ext/xml/xml.c
@@ -380,6 +380,9 @@ static void xml_parser_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
        if (parser->baseURI) {
                efree(parser->baseURI);
        }
+       if (parser->object) {
+               zval_ptr_dtor(&parser->object);
+       }
 
        efree(parser);
 }
@@ -1141,14 +1144,17 @@ PHP_FUNCTION(xml_set_object)
        if (parser->object) {
                zval_ptr_dtor(&parser->object);
        }
-       
-       parser->object = *mythis;
 
        /* please leave this commented - or ask thies@thieso.net before doing it (again) */
 /* #ifdef ZEND_ENGINE_2
        zval_add_ref(&parser->object); 
 #endif */
 
+       ALLOC_ZVAL(parser->object);
+       *parser->object = **mythis;
+       zval_copy_ctor(parser->object);
+       INIT_PZVAL(parser->object);
+
        RETVAL_TRUE;
 }
 /* }}} */