From: Nikita Popov <nikita.ppv@gmail.com>
Date: Mon, 31 Aug 2020 15:03:27 +0000 (+0200)
Subject: Fix leak on assign concat of array and empty string
X-Git-Tag: php-7.3.23RC1~14
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cd2afd99b1faa58c35a3807081e531cce0cd2311;p=php

Fix leak on assign concat of array and empty string
---

diff --git a/Zend/tests/assign_concat_array_empty_string.phpt b/Zend/tests/assign_concat_array_empty_string.phpt
new file mode 100644
index 0000000000..fcacb60675
--- /dev/null
+++ b/Zend/tests/assign_concat_array_empty_string.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Assign concat of array and empty string
+--FILE--
+<?php
+
+$a = [0];
+$a .= '';
+var_dump($a);
+
+?>
+--EXPECTF--
+Notice: Array to string conversion in %s on line %d
+string(5) "Array"
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index ef778ea100..45cdc1b11c 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -1836,6 +1836,9 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
 		}
 	} else if (UNEXPECTED(Z_STRLEN_P(op2) == 0)) {
 		if (EXPECTED(result != op1)) {
+			if (result == orig_op1) {
+				i_zval_ptr_dtor(result ZEND_FILE_LINE_CC);
+			}
 			ZVAL_COPY(result, op1);
 		}
 	} else {