From: Bob Weinand <bobwei9@hotmail.com>
Date: Tue, 26 May 2015 23:18:06 +0000 (+0200)
Subject: Fix memory leak with return types upon failure
X-Git-Tag: PRE_PHP7_NSAPI_REMOVAL~30^2~2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f7f7d6e385e91f70ee640018fd155dbd035a2e53;p=php

Fix memory leak with return types upon failure
TMP/VAR wasn't being freed in VERIFY_RETURN
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index efbb081922..55b72e90d7 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3909,6 +3909,9 @@ ZEND_VM_HANDLER(124, ZEND_VERIFY_RETURN_TYPE, CONST|TMP|VAR|UNUSED|CV, UNUSED)
 			}
 		}
 		zend_verify_return_type(EX(func), retval_ptr);
+		if (EG(exception)) {
+			FREE_OP1();
+		}
 #endif
 	}
 	CHECK_EXCEPTION();
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index cd95564219..1119dca1a2 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -7815,6 +7815,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CONST_
 			}
 		}
 		zend_verify_return_type(EX(func), retval_ptr);
+		if (EG(exception)) {
+
+		}
 #endif
 	}
 	CHECK_EXCEPTION();
@@ -13437,6 +13440,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_TMP_UN
 			}
 		}
 		zend_verify_return_type(EX(func), retval_ptr);
+		if (EG(exception)) {
+			zval_ptr_dtor_nogc(free_op1);
+		}
 #endif
 	}
 	CHECK_EXCEPTION();
@@ -19195,6 +19201,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_VAR_UN
 			}
 		}
 		zend_verify_return_type(EX(func), retval_ptr);
+		if (EG(exception)) {
+			zval_ptr_dtor_nogc(free_op1);
+		}
 #endif
 	}
 	CHECK_EXCEPTION();
@@ -25140,6 +25149,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_UNUSED
 			}
 		}
 		zend_verify_return_type(EX(func), retval_ptr);
+		if (EG(exception)) {
+
+		}
 #endif
 	}
 	CHECK_EXCEPTION();
@@ -34786,6 +34798,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CV_UNU
 			}
 		}
 		zend_verify_return_type(EX(func), retval_ptr);
+		if (EG(exception)) {
+
+		}
 #endif
 	}
 	CHECK_EXCEPTION();