From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 3 Oct 2007 09:47:25 +0000 (+0000)
Subject: Fixed bug #42818 ($foo = clone(array()); leaks memory)
X-Git-Tag: php-5.2.5RC1~56
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0cd4039af2fb9a61ca489ac6e2f3f28aabf637c3;p=php

Fixed bug #42818 ($foo = clone(array()); leaks memory)
---

diff --git a/NEWS b/NEWS
index f926254be2..0488d74c4c 100644
--- a/NEWS
+++ b/NEWS
@@ -32,6 +32,7 @@ PHP                                                                        NEWS
 - Fixed htmlentities/htmlspecialchars not to accept partial multibyte
   sequences. (Stas)
 
+- Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
 - Fixed bug #42785 (json_encode() formats doubles according to locale rather  
   then following standard syntax). (Ilia)
 - Fixed bug #42772 (Storing $this in a static var fails while handling a cast
diff --git a/Zend/tests/bug42818.phpt b/Zend/tests/bug42818.phpt
new file mode 100644
index 0000000000..a1d79a41e5
--- /dev/null
+++ b/Zend/tests/bug42818.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Bug #42818 ($foo = clone(array()); leaks memory)
+--FILE--
+<?php
+$foo = clone(array());
+?>
+--EXPECTF--
+Warning: __clone method called on non-object in %sbug42818.php on line 2
+
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 6405b09436..39235dba7b 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2534,7 +2534,7 @@ ZEND_VM_HANDLER(110, ZEND_CLONE, CONST|TMP|VAR|UNUSED|CV, ANY)
 		zend_error(E_WARNING, "__clone method called on non-object");
 		EX_T(opline->result.u.var).var.ptr = EG(error_zval_ptr);
 		EX_T(opline->result.u.var).var.ptr->refcount++;
-		FREE_OP1_IF_VAR();
+		FREE_OP1();
 		ZEND_VM_NEXT_OPCODE();
 	}
 
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 3ec65b0e3c..2caa1db50e 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -4415,7 +4415,7 @@ static int ZEND_CLONE_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		zend_error(E_WARNING, "__clone method called on non-object");
 		EX_T(opline->result.u.var).var.ptr = EG(error_zval_ptr);
 		EX_T(opline->result.u.var).var.ptr->refcount++;
-
+		zval_dtor(free_op1.var);
 		ZEND_VM_NEXT_OPCODE();
 	}