From: Xinchen Hui <laruence@php.net>
Date: Sun, 12 Feb 2012 04:59:08 +0000 (+0000)
Subject: Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX)
X-Git-Tag: PHP-5.4.1-RC1~26^2~85
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c578917e306b452493fed4a0aa2ecbd3a8c3f252;p=php

Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX)
---

diff --git a/NEWS b/NEWS
index 3e269e8084..e4f484e52d 100644
--- a/NEWS
+++ b/NEWS
@@ -45,6 +45,10 @@ PHP                                                                        NEWS
   . Fixed bug #60968 (Late static binding doesn't work with 
     ReflectionMethod::invokeArgs()). (Laruence)
 
+- Array:
+  . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX).
+    (Laruence)
+
 ?? ??? 2012, PHP 5.3.10
 
 (to be added)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 060d665195..3ca1a69a5e 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1558,11 +1558,15 @@ PHP_FUNCTION(array_fill)
 
 	num--;
 	zval_add_ref(&val);
-	zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL);
+	if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) {
+		zval_ptr_dtor(&val);
+	}
 
 	while (num--) {
 		zval_add_ref(&val);
-		zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) {
+			zval_ptr_dtor(&val);
+		}
 	}
 }
 /* }}} */