From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 18 Dec 2019 16:18:10 +0000 (+0100)
Subject: Fix leak in assign_ref with function
X-Git-Tag: php-7.4.7RC1~402
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=df08d6bffe0faaa76bfcccac8869c0731ef8bd70;p=php

Fix leak in assign_ref with function

As far as I can see, the retval copying is already done in all
callers of this function, so it should not be duplicated here.
---

diff --git a/Zend/tests/assign_ref_func_leak.phpt b/Zend/tests/assign_ref_func_leak.phpt
new file mode 100644
index 0000000000..fe4c8017b6
--- /dev/null
+++ b/Zend/tests/assign_ref_func_leak.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Assigning the result of a non-reference function by-reference should not leak
+--FILE--
+<?php
+
+function func() {
+    return [0];
+}
+
+$x = $y =& func();
+var_dump($x, $y);
+
+?>
+--EXPECTF--
+Notice: Only variables should be assigned by reference in %s on line %d
+array(1) {
+  [0]=>
+  int(0)
+}
+array(1) {
+  [0]=>
+  int(0)
+}
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index c1ff85bff8..3b980e8776 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -596,9 +596,6 @@ static zend_never_inline ZEND_COLD int zend_wrong_assign_to_variable_reference(z
 	Z_TRY_ADDREF_P(value_ptr);
 	value_ptr = zend_assign_to_variable(variable_ptr, value_ptr, IS_TMP_VAR, EX_USES_STRICT_TYPES());
 
-	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-		ZVAL_COPY(EX_VAR(opline->result.var), value_ptr);
-	}
 	return 1;
 }