From 33125e2312045e26853c5a44f255d56b9742edaf Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Sun, 12 Feb 2012 05:32:24 +0000
Subject: [PATCH] Improved fix for #61058, and add test script
---
ext/standard/array.c | 15 ++++++++-------
ext/standard/tests/array/bug61058.phpt | 8 ++++++++
2 files changed, 16 insertions(+), 7 deletions(-)
create mode 100644 ext/standard/tests/array/bug61058.phpt
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 3ca1a69a5e..f18d558bbe 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1557,15 +1557,16 @@ PHP_FUNCTION(array_fill)
array_init_size(return_value, num);
num--;
- zval_add_ref(&val);
- if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) {
- zval_ptr_dtor(&val);
- }
+ zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL);
+ zval_add_ref(&val);
while (num--) {
- zval_add_ref(&val);
- if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) {
- zval_ptr_dtor(&val);
+ if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == SUCCESS) {
+ zval_add_ref(&val);
+ } else {
+ zval_dtor(return_value);
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot add element to the array as the next element is already occupied");
+ RETURN_FALSE;
}
}
}
diff --git a/ext/standard/tests/array/bug61058.phpt b/ext/standard/tests/array/bug61058.phpt
new file mode 100644
index 0000000000..1f0f6fe630
--- /dev/null
+++ b/ext/standard/tests/array/bug61058.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Bug #61058 (array_fill leaks if start index is PHP_INT_MAX)
+--FILE--
+<?php
+array_fill(PHP_INT_MAX, 2, '*');
+?>
+--EXPECTF--
+Warning: array_fill(): Cannot add element to the array as the next element is already occupied in %sbug61058.php on line %d
--
2.40.0