From f22b3a19cff7950cc92c7b56e342f9a64629cb54 Mon Sep 17 00:00:00 2001
From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Sun, 26 Oct 2003 16:10:07 +0000
Subject: [PATCH] Prevent leaks in the overload extension that occur in some
 special cases.

---
 ext/overload/overload.c       |  9 +++------
 tests/lang/overload_leak.phpt | 27 +++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 6 deletions(-)
 create mode 100644 tests/lang/overload_leak.phpt

diff --git a/ext/overload/overload.c b/ext/overload/overload.c
index ebd38a9b79..343ecfe81f 100644
--- a/ext/overload/overload.c
+++ b/ext/overload/overload.c
@@ -580,18 +580,16 @@ static void overload_call_method(INTERNAL_FUNCTION_PARAMETERS, zend_property_ref
 		}
 
 		if (zval_is_true(retval)) {
-			*return_value = *result_ptr;
-			INIT_PZVAL(return_value);
+			REPLACE_ZVAL_VALUE(&return_value, result_ptr, 1);
 		} else {
 			zval_dtor(result_ptr);
 			php_error(E_WARNING, "Call to undefined method %s::%s()", Z_OBJCE_P(object)->name, Z_STRVAL(method_name));
 		}
 		zval_ptr_dtor(&retval);
 	} else {
-		ZVAL_STRINGL(&call_handler, Z_STRVAL(method->element), Z_STRLEN(method->element), 0);
 		call_result = call_user_function_ex(NULL,
 											&object,
-											&call_handler,
+											&method->element,
 											&retval,
 											ZEND_NUM_ARGS(), args,
 											0, NULL TSRMLS_CC);
@@ -602,8 +600,7 @@ static void overload_call_method(INTERNAL_FUNCTION_PARAMETERS, zend_property_ref
 			return;
 		}
 
-		*return_value = *retval;
-		zval_copy_ctor(return_value);
+		REPLACE_ZVAL_VALUE(&return_value, retval, 1);
 		zval_ptr_dtor(&retval);
 	}
 	
diff --git a/tests/lang/overload_leak.phpt b/tests/lang/overload_leak.phpt
new file mode 100644
index 0000000000..fbe51573a6
--- /dev/null
+++ b/tests/lang/overload_leak.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Memory leaks occur within an overloaded method that returns a reference
+--FILE--
+<?php
+class foo {
+	function foo() {
+	}
+	function __call($m, $a, &$r) {
+		return true;
+	}
+	function &bar() {
+		global $g;
+		var_dump($g);
+		return $g;
+	}
+}
+
+$g = 456;
+
+overload('foo');
+
+$a = new foo();
+var_dump($a->bar());
+?>
+--EXPECT--
+int(456)
+int(456)
-- 
2.50.1