From 631a00a0a0925a3eae24c409ec24d4b47e20ea8e Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 11 Jul 2006 08:52:28 +0000
Subject: [PATCH] Fixed memory leak in case of exception in iterator callbacks
 in 'foreach(new Iterator()...' (spl/tests/iterator_047.phpt).

---
 Zend/zend_vm_def.h     | 10 ++++++++++
 Zend/zend_vm_execute.h | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index ed521c9c72..cbf2f1fb61 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3091,6 +3091,11 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 			if (EG(exception)) {
 				array_ptr->refcount--;
 				zval_ptr_dtor(&array_ptr);
+				if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+					FREE_OP1_VAR_PTR();
+				} else {
+					FREE_OP1_IF_VAR();
+				}
 				ZEND_VM_NEXT_OPCODE();
 			}
 		}
@@ -3098,6 +3103,11 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 		if (EG(exception)) {
 			array_ptr->refcount--;
 			zval_ptr_dtor(&array_ptr);
+			if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+				FREE_OP1_VAR_PTR();
+			} else {
+				FREE_OP1_IF_VAR();
+			}
 			ZEND_VM_NEXT_OPCODE();
 		}
 		iter->index = -1; /* will be set to 0 before using next handler */
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 02582bdb00..f752cd7efd 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2163,6 +2163,11 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			if (EG(exception)) {
 				array_ptr->refcount--;
 				zval_ptr_dtor(&array_ptr);
+				if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+				} else {
+
+				}
 				ZEND_VM_NEXT_OPCODE();
 			}
 		}
@@ -2170,6 +2175,11 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		if (EG(exception)) {
 			array_ptr->refcount--;
 			zval_ptr_dtor(&array_ptr);
+			if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+			} else {
+
+			}
 			ZEND_VM_NEXT_OPCODE();
 		}
 		iter->index = -1; /* will be set to 0 before using next handler */
@@ -4663,6 +4673,11 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			if (EG(exception)) {
 				array_ptr->refcount--;
 				zval_ptr_dtor(&array_ptr);
+				if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+				} else {
+
+				}
 				ZEND_VM_NEXT_OPCODE();
 			}
 		}
@@ -4670,6 +4685,11 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		if (EG(exception)) {
 			array_ptr->refcount--;
 			zval_ptr_dtor(&array_ptr);
+			if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+			} else {
+
+			}
 			ZEND_VM_NEXT_OPCODE();
 		}
 		iter->index = -1; /* will be set to 0 before using next handler */
@@ -7745,6 +7765,11 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			if (EG(exception)) {
 				array_ptr->refcount--;
 				zval_ptr_dtor(&array_ptr);
+				if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+				} else {
+					if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+				}
 				ZEND_VM_NEXT_OPCODE();
 			}
 		}
@@ -7752,6 +7777,11 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		if (EG(exception)) {
 			array_ptr->refcount--;
 			zval_ptr_dtor(&array_ptr);
+			if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+			} else {
+				if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+			}
 			ZEND_VM_NEXT_OPCODE();
 		}
 		iter->index = -1; /* will be set to 0 before using next handler */
@@ -19983,6 +20013,11 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			if (EG(exception)) {
 				array_ptr->refcount--;
 				zval_ptr_dtor(&array_ptr);
+				if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+				} else {
+
+				}
 				ZEND_VM_NEXT_OPCODE();
 			}
 		}
@@ -19990,6 +20025,11 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		if (EG(exception)) {
 			array_ptr->refcount--;
 			zval_ptr_dtor(&array_ptr);
+			if (opline->extended_value & ZEND_FE_RESET_VARIABLE) {
+
+			} else {
+
+			}
 			ZEND_VM_NEXT_OPCODE();
 		}
 		iter->index = -1; /* will be set to 0 before using next handler */
-- 
2.50.1