From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 23 Aug 2019 13:27:28 +0000 (+0200)
Subject: Fixed bug #78436
X-Git-Tag: php-7.4.0RC1~57
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=13e92223c0c102b33b775ff1e4f27bcca72f0eb9;p=php

Fixed bug #78436
---

diff --git a/NEWS b/NEWS
index 8fa0367077..45df257660 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed bug #78441 (Parse error due to heredoc identifier followed by digit).
     (cmb)
 
+- SPL:
+  . Fixed bug #78436 (Missing addref in SplPriorityQueue EXTR_BOTH mode).
+    (Nikita)
+
 22 Aug 2019, PHP 7.4.0beta4
 
 - Core:
diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c
index 6de7adb762..af0043b94b 100644
--- a/ext/spl/spl_heap.c
+++ b/ext/spl/spl_heap.c
@@ -144,7 +144,9 @@ static void spl_pqueue_extract_helper(zval *result, zval *value, int flags) /* {
 	spl_pqueue_elem *elem = Z_PTR_P(value);
 	if ((flags & SPL_PQUEUE_EXTR_BOTH) == SPL_PQUEUE_EXTR_BOTH) {
 		array_init(result);
+		Z_TRY_ADDREF(elem->data);
 		add_assoc_zval_ex(result, "data", sizeof("data") - 1, &elem->data);
+		Z_TRY_ADDREF(elem->priority);
 		add_assoc_zval_ex(result, "priority", sizeof("priority") - 1, &elem->priority);
 		return;
 	}
diff --git a/ext/spl/tests/bug78436.phpt b/ext/spl/tests/bug78436.phpt
new file mode 100644
index 0000000000..8b978d5a4b
--- /dev/null
+++ b/ext/spl/tests/bug78436.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Bug #78436: Missing addref in SplPriorityQueue EXTR_BOTH mode
+--FILE--
+<?php
+
+$pq = new SplPriorityQueue();
+$pq->insert(new stdClass, 1);
+var_dump($pq);
+var_dump($pq);
+
+?>
+--EXPECT--
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}