Fix assignments of reference variables

diff --git a/Zend/zend.c b/Zend/zend.c
index 9c2b23b31f704354d1319d8f33250bde952ecc75..737f2885081e80aab274dcfcb716222f2eb914f9 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -82,6 +82,7 @@ static void print_hash(HashTable *ht, int indent)
                switch (zend_hash_get_current_key(ht, &string_key, &num_key)) {
                        case HASH_KEY_IS_STRING:
                                ZEND_PUTS(string_key);
+                               efree(string_key);
                                break;
                        case HASH_KEY_IS_LONG:
                                zend_printf("%ld",num_key);

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index fc3a9a8d74389e73abbe976015368167bb423a32..b7cc55b01baaffabc8b9e41a988429793e39d724 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -264,6 +264,7 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
                        short refcount=variable_ptr->refcount;
        
                        previous_lock_count = variable_ptr->EA.locks;
+                       value->refcount++;
                        zendi_zval_dtor(*variable_ptr);
                        *variable_ptr = *value;
                        variable_ptr->refcount = refcount;
@@ -271,6 +272,7 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
                        variable_ptr->EA.locks = previous_lock_count;
                        if (type!=IS_TMP_VAR) {
                                zendi_zval_copy_ctor(*variable_ptr);
+                               zval_ptr_dtor(&value);
                        }
                }
        } else {