fix premature freeing of BG(locale_string)

the returned string has to be refcounted

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 2c60e207fb7ee32e937628d0afa9808122f7a039..fc25456c555e451dd166ac8f1f0f889ba7d3427b 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4550,12 +4550,11 @@ PHP_FUNCTION(setlocale)
                                        }
                                        if (len == loc->len && !memcmp(loc->val, retval, len)) {
                                                BG(locale_string) = zend_string_copy(loc);
-                                               RETURN_STR(BG(locale_string));
                                        } else {
                                                BG(locale_string) = zend_string_init(retval, len, 0);
                                                zend_string_release(loc);
-                                               RETURN_STR(BG(locale_string));
                                        }
+                                       RETURN_STR(zend_string_copy(BG(locale_string)));
                                } else if (len == loc->len && !memcmp(loc->val, retval, len)) {
                                        RETURN_STR(loc);
                                }