From: Dmitry Stogov <dmitry@zend.com>
Date: Thu, 6 Mar 2014 10:42:16 +0000 (+0400)
Subject: Fixed memory leak
X-Git-Tag: POST_PHPNG_MERGE~412^2~398^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=08aadb063853a31af16c4eb3ac2a7e3dab13db46;p=php

Fixed memory leak
---

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 856c94a22b..325b242122 100644
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -371,6 +371,7 @@ php_sprintf_getnumber(char *buffer, int *pos)
 static zend_string *
 php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 {
+	zval *newargs = NULL;
 	zval *args, *z_format;
 	int argc, size = 240, inpos = 0, outpos = 0, temppos;
 	int alignment, currarg, adjusting, argnum, width, precision;
@@ -390,7 +391,7 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 	
 	if (use_array) {
 		int i = 1;
-		zval *newargs, *zv;
+		zval *zv;
 		zval array;
 
 		z_format = &args[format_offset];
@@ -448,6 +449,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 
 					if (argnum <= 0) {
 						efree(result);
+						if (newargs) {
+							efree(newargs);
+						}
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument number must be greater than zero");
 						return NULL;
 					}
@@ -488,6 +492,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 					PRINTF_DEBUG(("sprintf: getting width\n"));
 					if ((width = php_sprintf_getnumber(format, &inpos)) < 0) {
 						efree(result);
+						if (newargs) {
+							efree(newargs);
+						}
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Width must be greater than zero and less than %d", INT_MAX);
 						return NULL;
 					}
@@ -504,6 +511,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 					if (isdigit((int)format[inpos])) {
 						if ((precision = php_sprintf_getnumber(format, &inpos)) < 0) {
 							efree(result);
+							if (newargs) {
+								efree(newargs);
+							}
 							php_error_docref(NULL TSRMLS_CC, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX);
 							return NULL;
 						}
@@ -523,6 +533,9 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 
 			if (argnum >= argc) {
 				efree(result);
+				if (newargs) {
+					efree(newargs);
+				}
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
 				return NULL;
 			}
@@ -643,6 +656,10 @@ php_formatted_print(int param_count, int use_array, int format_offset TSRMLS_DC)
 		}
 	}
 	
+	if (newargs) {
+		efree(newargs);
+	}
+
 	/* possibly, we have to make sure we have room for the terminating null? */
 	result->val[outpos]=0;
 	result->len = outpos;