Prevent leaks in the overload extension that occur in some special cases.

diff --git a/ext/overload/overload.c b/ext/overload/overload.c
index ebd38a9b79b6383bc3ffe01660eca0f238ead0c0..343ecfe81f697e4c6f7b492a4ae83d3ecb4a5276 100644 (file)
--- a/ext/overload/overload.c
+++ b/ext/overload/overload.c
@@ -580,18 +580,16 @@ static void overload_call_method(INTERNAL_FUNCTION_PARAMETERS, zend_property_ref
                }
 
                if (zval_is_true(retval)) {
-                       *return_value = *result_ptr;
-                       INIT_PZVAL(return_value);
+                       REPLACE_ZVAL_VALUE(&return_value, result_ptr, 1);
                } else {
                        zval_dtor(result_ptr);
                        php_error(E_WARNING, "Call to undefined method %s::%s()", Z_OBJCE_P(object)->name, Z_STRVAL(method_name));
                }
                zval_ptr_dtor(&retval);
        } else {
-               ZVAL_STRINGL(&call_handler, Z_STRVAL(method->element), Z_STRLEN(method->element), 0);
                call_result = call_user_function_ex(NULL,
                                                                                        &object,
-                                                                                       &call_handler,
+                                                                                       &method->element,
                                                                                        &retval,
                                                                                        ZEND_NUM_ARGS(), args,
                                                                                        0, NULL TSRMLS_CC);
@@ -602,8 +600,7 @@ static void overload_call_method(INTERNAL_FUNCTION_PARAMETERS, zend_property_ref
                        return;
                }
 
-               *return_value = *retval;
-               zval_copy_ctor(return_value);
+               REPLACE_ZVAL_VALUE(&return_value, retval, 1);
                zval_ptr_dtor(&retval);
        }
        

diff --git a/tests/lang/overload_leak.phpt b/tests/lang/overload_leak.phpt
new file mode 100644 (file)
index 0000000..fbe5157
--- /dev/null
+++ b/tests/lang/overload_leak.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Memory leaks occur within an overloaded method that returns a reference
+--FILE--
+<?php
+class foo {
+       function foo() {
+       }
+       function __call($m, $a, &$r) {
+               return true;
+       }
+       function &bar() {
+               global $g;
+               var_dump($g);
+               return $g;
+       }
+}
+
+$g = 456;
+
+overload('foo');
+
+$a = new foo();
+var_dump($a->bar());
+?>
+--EXPECT--
+int(456)
+int(456)