From 6fcde56b0370125c32e6a7d198aff2afd01c35dc Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Mon, 30 Sep 2019 15:05:35 +0200
Subject: [PATCH] Fixed bug #78612

---
 NEWS                                     |  2 ++
 ext/standard/string.c                    |  1 +
 ext/standard/tests/strings/bug78612.phpt | 18 ++++++++++++++++++
 3 files changed, 21 insertions(+)
 create mode 100644 ext/standard/tests/strings/bug78612.phpt

diff --git a/NEWS b/NEWS
index 89a65dd49e..1c4ce6fe5d 100644
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #76342 (file_get_contents waits twice specified timeout).
     (Thomas Calvet)
+  . Fixed bug #78612 (strtr leaks memory when integer keys are used and the
+    subject string shorter). (Nikita)
 
 26 Sep 2019, PHP 7.2.23
 
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 2907c2253b..dcf9cb44c7 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3027,6 +3027,7 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p
 				len = ZSTR_LEN(key_used);
 				if (UNEXPECTED(len > slen)) {
 					/* skip long patterns */
+					zend_string_release(key_used);
 					continue;
 				}
 				if (len > maxlen) {
diff --git a/ext/standard/tests/strings/bug78612.phpt b/ext/standard/tests/strings/bug78612.phpt
new file mode 100644
index 0000000000..7dad605e80
--- /dev/null
+++ b/ext/standard/tests/strings/bug78612.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #78612 (strtr leaks memory when integer keys are used and the subject string shorter).
+--FILE--
+<?php
+
+$find_replace = array();
+$_a = 7111222333000001;
+$_b = 5000001;
+
+for ($j=0; $j<10; $j++) {
+	$find_replace[$_a + $j] = $_b + $j;
+}
+
+echo strtr('Hello', $find_replace), "\n";
+
+?>
+--EXPECT--
+Hello
-- 
2.40.0