Fix zend_fcall_info_arg*() to use ZVAL_COPY

As zend_fcall_info_args_clear() calls zval_ptr_dtor() we also have
to increase the refcount of refcounted zvals added as params,
like it is already done in zend_fcall_info_args_ex().

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 10efd7ab5bb841b965486f8ffb4129e1d33084a4..369852ffbef28e54c968ead7d48115533c5b1ca3 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3504,7 +3504,7 @@ ZEND_API int zend_fcall_info_argp(zend_fcall_info *fci TSRMLS_DC, int argc, zval
                fci->params = (zval *) erealloc(fci->params, fci->param_count * sizeof(zval));
 
                for (i = 0; i < argc; ++i) {
-                       ZVAL_COPY_VALUE(&fci->params[i], &argv[i]);
+                       ZVAL_COPY(&fci->params[i], &argv[i]);
                }
        }
 
@@ -3529,7 +3529,7 @@ ZEND_API int zend_fcall_info_argv(zend_fcall_info *fci TSRMLS_DC, int argc, va_l
 
                for (i = 0; i < argc; ++i) {
                        arg = va_arg(*argv, zval *);
-                       ZVAL_COPY_VALUE(&fci->params[i], arg);
+                       ZVAL_COPY(&fci->params[i], arg);
                }
        }
 

diff --git a/main/output.c b/main/output.c
index a1530b63fc9db155e496b6ece74c98db277bfe64..c8b41ba1eb0c2f70d9ac9ac3ea4ddbc2bddd793b 100644 (file)
--- a/main/output.c
+++ b/main/output.c
@@ -961,6 +961,7 @@ static inline php_output_handler_status_t php_output_handler_op(php_output_handl
                        ZVAL_STRINGL(&ob_data, handler->buffer.data, handler->buffer.used);
                        ZVAL_LONG(&ob_mode, (zend_long) context->op);
                        zend_fcall_info_argn(&handler->func.user->fci TSRMLS_CC, 2, &ob_data, &ob_mode);
+                       zval_ptr_dtor(&ob_data);
 
 #define PHP_OUTPUT_USER_SUCCESS(retval) ((Z_TYPE(retval) != IS_UNDEF) && !(Z_TYPE(retval) == IS_FALSE))
                        if (SUCCESS == zend_fcall_info_call(&handler->func.user->fci, &handler->func.user->fcc, &retval, NULL TSRMLS_CC) && PHP_OUTPUT_USER_SUCCESS(retval)) {