PHPC-1698: fix prep_tagsets leak for ReadPreference::__set_state (#1167)

Author: jmikola

src/MongoDB/ReadPreference.c

@@ -311,7 +311,10 @@ static PHP_METHOD(ReadPreference, __set_state)
 	HashTable*                   props;
 	zval*                        array;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "a", &array) == FAILURE) {
+	/* Separate the zval, since we may end up modifying the "tags" element in
+	 * php_phongo_read_preference_prep_tagsets(), which is called from
+	 * php_phongo_readpreference_init_from_hash. */
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "a/", &array) == FAILURE) {
 		RETURN_FALSE;
 	}
 

tests/readPreference/bug1698-001.phpt

@@ -0,0 +1,86 @@
+--TEST--
+PHPC-1698: php_phongo_read_preference_prep_tagsets may leak in convert_to_object
+--FILE--
+<?php
+
+require_once __DIR__ . '/../utils/tools.php';
+
+$args = ['mode' => 'secondary', 'tags' => [['dc' => 'ny']]];
+var_dump(MongoDB\Driver\ReadPreference::__set_state($args));
+var_dump($args);
+
+$tagSets = [['dc' => 'ny']];
+var_dump(new MongoDB\Driver\ReadPreference('secondary', $tagSets));
+var_dump($tagSets);
+
+$uriTagSets = [['dc' => 'ny']];
+var_dump((new MongoDB\Driver\Manager(null, ['readPreference' => 'secondary', 'readPreferenceTags' => $uriTagSets]))->getReadPreference());
+var_dump($uriTagSets);
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+object(MongoDB\Driver\ReadPreference)#%d (2) {
+  ["mode"]=>
+  string(9) "secondary"
+  ["tags"]=>
+  array(1) {
+    [0]=>
+    object(stdClass)#%d (1) {
+      ["dc"]=>
+      string(2) "ny"
+    }
+  }
+}
+array(2) {
+  ["mode"]=>
+  string(9) "secondary"
+  ["tags"]=>
+  array(1) {
+    [0]=>
+    object(stdClass)#%d (1) {
+      ["dc"]=>
+      string(2) "ny"
+    }
+  }
+}
+object(MongoDB\Driver\ReadPreference)#%d (2) {
+  ["mode"]=>
+  string(9) "secondary"
+  ["tags"]=>
+  array(1) {
+    [0]=>
+    object(stdClass)#%d (1) {
+      ["dc"]=>
+      string(2) "ny"
+    }
+  }
+}
+array(1) {
+  [0]=>
+  array(1) {
+    ["dc"]=>
+    string(2) "ny"
+  }
+}
+object(MongoDB\Driver\ReadPreference)#%d (2) {
+  ["mode"]=>
+  string(9) "secondary"
+  ["tags"]=>
+  array(1) {
+    [0]=>
+    object(stdClass)#%d (1) {
+      ["dc"]=>
+      string(2) "ny"
+    }
+  }
+}
+array(1) {
+  [0]=>
+  array(1) {
+    ["dc"]=>
+    string(2) "ny"
+  }
+}
+===DONE===