From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 18 Aug 2014 17:08:50 +0000 (+0400)
Subject: Fixed bug #67856 (Leak when using array_reduce with by-ref function)
X-Git-Tag: PRE_64BIT_BRANCH_MERGE~47
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0f5bad93fd9eb0bb73855b536d15c6b6bacb6dbc;p=php

Fixed bug #67856 (Leak when using array_reduce with by-ref function)
---

diff --git a/Zend/tests/bug67856.phpt b/Zend/tests/bug67856.phpt
new file mode 100644
index 0000000000..e867c8f37c
--- /dev/null
+++ b/Zend/tests/bug67856.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #67856 (Leak when using array_reduce with by-ref function)
+--FILE--
+<?php
+$array = [1, 2, 3];
+var_dump(array_reduce($array, function(&$a, &$b) {
+    return $a + $b;
+}, 0));
+?>
+--EXPECT--
+int(6)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index a177ee7e0f..b503162b86 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4298,14 +4298,18 @@ PHP_FUNCTION(array_reduce)
 	fci.no_separation = 0;
 
 	ZEND_HASH_FOREACH_VAL(htbl, operand) {
-		ZVAL_COPY_VALUE(&args[0], &result);
-		ZVAL_COPY_VALUE(&args[1], operand);
+		ZVAL_COPY(&args[0], &result);
+		ZVAL_COPY(&args[1], operand);
 		fci.params = args;
 
 		if (zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS && Z_TYPE(retval) != IS_UNDEF) {
+			zval_ptr_dtor(&args[1]);
+			zval_ptr_dtor(&args[0]);
 			zval_ptr_dtor(&result);
 			ZVAL_COPY_VALUE(&result, &retval);
 		} else {
+			zval_ptr_dtor(&args[1]);
+			zval_ptr_dtor(&args[0]);
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the reduction callback");
 			return;
 		}