From: Dmitry Stogov <dmitry@php.net>
Date: Fri, 3 Jun 2005 13:57:26 +0000 (+0000)
Subject: Fixed bug #27598 (list() array key assignment causes HUGE memory leak)
X-Git-Tag: php-5.0.1b1~100
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6b39b374ef5f2711ca2bfa63f1982c4026ff2397;p=php

Fixed bug #27598 (list() array key assignment causes HUGE memory leak)
---

diff --git a/Zend/tests/bug27598.phpt b/Zend/tests/bug27598.phpt
new file mode 100755
index 0000000000..534e8cf857
--- /dev/null
+++ b/Zend/tests/bug27598.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #27598 (list() array key assignment causes HUGE memory leak)
+--FILE--
+<?php
+list($out[0]) = array(1);
+var_dump($out);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index cfc1a59ef1..d2afe43b6b 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3102,7 +3102,6 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
 	zend_llist_element *dimension;
 	zend_op *opline;
 	znode last_container;
-	int opcode_index;
 	int last_op_number;
 	zend_op *last_op;
 
@@ -3145,14 +3144,10 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
 		((list_llist_element *) le->data)->value = last_container;
 		zend_llist_destroy(&((list_llist_element *) le->data)->dimensions);
 		zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
-		opcode_index = - 1;
 		last_op_number = get_next_op_number(CG(active_op_array))-1;
 		last_op = &CG(active_op_array)->opcodes[last_op_number];
-		if (last_op->opcode == ZEND_FETCH_OBJ_W) {
-			opcode_index = - 2;
-		}
 		zend_do_assign(result, &((list_llist_element *) le->data)->var, &((list_llist_element *) le->data)->value TSRMLS_CC);
-		CG(active_op_array)->opcodes[CG(active_op_array)->last + opcode_index].result.u.EA.type |= EXT_TYPE_UNUSED;
+		zend_do_free(result TSRMLS_CC);
 		le = le->next;
 	}
 	zend_llist_destroy(&CG(dimension_llist));