From: Michael Wallner <mike@php.net>
Date: Thu, 4 Dec 2014 12:02:30 +0000 (+0100)
Subject: Fix zend_fcall_info_arg*() to use ZVAL_COPY
X-Git-Tag: PRE_NATIVE_TLS_MERGE~66
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f0a17c293b5b240a4da27e6b5f89dbd9c9183488;p=php

Fix zend_fcall_info_arg*() to use ZVAL_COPY

As zend_fcall_info_args_clear() calls zval_ptr_dtor() we also have
to increase the refcount of refcounted zvals added as params,
like it is already done in zend_fcall_info_args_ex().
---

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 10efd7ab5b..369852ffbe 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3504,7 +3504,7 @@ ZEND_API int zend_fcall_info_argp(zend_fcall_info *fci TSRMLS_DC, int argc, zval
 		fci->params = (zval *) erealloc(fci->params, fci->param_count * sizeof(zval));
 
 		for (i = 0; i < argc; ++i) {
-			ZVAL_COPY_VALUE(&fci->params[i], &argv[i]);
+			ZVAL_COPY(&fci->params[i], &argv[i]);
 		}
 	}
 
@@ -3529,7 +3529,7 @@ ZEND_API int zend_fcall_info_argv(zend_fcall_info *fci TSRMLS_DC, int argc, va_l
 
 		for (i = 0; i < argc; ++i) {
 			arg = va_arg(*argv, zval *);
-			ZVAL_COPY_VALUE(&fci->params[i], arg);
+			ZVAL_COPY(&fci->params[i], arg);
 		}
 	}
 
diff --git a/main/output.c b/main/output.c
index a1530b63fc..c8b41ba1eb 100644
--- a/main/output.c
+++ b/main/output.c
@@ -961,6 +961,7 @@ static inline php_output_handler_status_t php_output_handler_op(php_output_handl
 			ZVAL_STRINGL(&ob_data, handler->buffer.data, handler->buffer.used);
 			ZVAL_LONG(&ob_mode, (zend_long) context->op);
 			zend_fcall_info_argn(&handler->func.user->fci TSRMLS_CC, 2, &ob_data, &ob_mode);
+			zval_ptr_dtor(&ob_data);
 
 #define PHP_OUTPUT_USER_SUCCESS(retval) ((Z_TYPE(retval) != IS_UNDEF) && !(Z_TYPE(retval) == IS_FALSE))
 			if (SUCCESS == zend_fcall_info_call(&handler->func.user->fci, &handler->func.user->fcc, &retval, NULL TSRMLS_CC) && PHP_OUTPUT_USER_SUCCESS(retval)) {