From 382f9b28e8390a49137fc028a0c04d291781ae7a Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 10 Oct 2019 10:07:54 +0200
Subject: [PATCH] Fix leak on "Cannot assign by reference to overloaded object"
 error

---
 Zend/tests/bug70083.phpt | 17 +++++++++++------
 Zend/zend_execute.c      |  1 +
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/Zend/tests/bug70083.phpt b/Zend/tests/bug70083.phpt
index 6b20eabb39..5bc3656e9f 100644
--- a/Zend/tests/bug70083.phpt
+++ b/Zend/tests/bug70083.phpt
@@ -13,12 +13,17 @@ class foo {
 function &noref() { $foo = 1; return $foo; }
 
 $foo = new foo;
-$foo->i = &noref();
+try {
+    $foo->i = &noref();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
 var_dump($foo);
 
 ?>
---EXPECTF--
-Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
-Stack trace:
-#0 {main}
-  thrown in %s on line %d
+--EXPECT--
+Cannot assign by reference to overloaded object
+object(foo)#1 (1) {
+  ["var":"foo":private]=>
+  NULL
+}
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 015ee8990f..b69d0a88d5 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2862,6 +2862,7 @@ static zend_always_inline void zend_assign_to_property_reference(zval *container
 		variable_ptr = &EG(uninitialized_zval);
 	} else if (UNEXPECTED(Z_TYPE(variable) != IS_INDIRECT)) {
 		zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
+		zval_ptr_dtor(&variable);
 		variable_ptr = &EG(uninitialized_zval);
 	} else if (/*OP_DATA_TYPE == IS_VAR &&*/ UNEXPECTED(Z_ISERROR_P(value_ptr))) {
 		variable_ptr = &EG(uninitialized_zval);
-- 
2.40.0