From 2b5fc8e325e3f385851ab7a7a77010bbccd2b16e Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 11 Mar 2020 18:29:40 +0100
Subject: [PATCH] Fix #79199: curl_copy_handle() memory leak

`curl_copy_handle()` already registers a new resource, so we must not
increase the refcount of the original resource.
---
 NEWS                         |  3 +++
 ext/curl/interface.c         |  2 --
 ext/curl/tests/bug79199.phpt | 24 ++++++++++++++++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 ext/curl/tests/bug79199.phpt

diff --git a/NEWS b/NEWS
index 8fd4c708fd..32db597c9b 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)
   . Fixed bug #78210 (Invalid pointer address). (cmb, Nikita)
 
+- CURL:
+  . Fixed bug #79199 (curl_copy_handle() memory leak). (cmb)
+
 - SimpleXML:
   . Fixed bug #61597 (SXE properties may lack attributes and content). (cmb)
 
diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index f6707310f4..630d3b0a89 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -2167,8 +2167,6 @@ PHP_FUNCTION(curl_copy_handle)
 
 	_php_setup_easy_copy_handlers(dupch, ch);
 
-	Z_ADDREF_P(zid);
-
 	ZVAL_RES(return_value, zend_register_resource(dupch, le_curl));
 	dupch->res = Z_RES_P(return_value);
 }
diff --git a/ext/curl/tests/bug79199.phpt b/ext/curl/tests/bug79199.phpt
new file mode 100644
index 0000000000..b56f22614f
--- /dev/null
+++ b/ext/curl/tests/bug79199.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #79199 (curl_copy_handle() memory leak)
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip curl extension not available');
+?>
+--FILE--
+<?php
+$mem_old = 0;
+for($i = 0; $i < 50; ++$i) {
+    $c1 = curl_init();
+    $c2 = curl_copy_handle($c1);
+    curl_close($c2);
+    curl_close($c1);
+    $mem_new = memory_get_usage();
+    if ($mem_new <= $mem_old) {
+        break;
+    }
+    $mem_old = $mem_new;
+}
+echo $i < 50 ? "okay" : "leak", PHP_EOL;
+?>
+--EXPECT--
+okay
-- 
2.40.0