From 95cbb0046cda6dff8d44422d04b629d0fd6522ff Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Wed, 18 Feb 2004 19:48:13 +0000
Subject: [PATCH] Fixed bug #27295 (memory leak inside sscanf()).

---
 ext/standard/scanf.c                     |  2 +-
 ext/standard/tests/strings/bug27295.phpt | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/strings/bug27295.phpt

diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c
index 675cef897b..ba158e598c 100644
--- a/ext/standard/scanf.c
+++ b/ext/standard/scanf.c
@@ -933,7 +933,7 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 				if (!(flags & SCAN_SUPPRESS)) {
 					if (numVars) {
 						current = args[objIndex++];
-						convert_to_string( *current );
+						zval_dtor( *current );
 						ZVAL_STRINGL( *current, string, end-string, 1);
 					} else {
 						add_index_stringl(*return_value, objIndex++, string, end-string, 1);
diff --git a/ext/standard/tests/strings/bug27295.phpt b/ext/standard/tests/strings/bug27295.phpt
new file mode 100644
index 0000000000..d23d27049f
--- /dev/null
+++ b/ext/standard/tests/strings/bug27295.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #27295 (memory leak inside sscanf())
+--FILE--
+<?php
+$strings = array("foo = bar", "bar = foo");
+foreach( $strings as $string )
+{
+	sscanf( $string, "%s = %[^[]]", $var, $val );
+	echo "$var = $val\n";
+}
+?>
+--EXPECT--
+foo = bar
+bar = foo
-- 
2.50.1