Merge branch 'PHP-7.4'

nikic · nikic · commit 4acac9bd7263 · 2020-08-31T17:06:21.000+02:00
* PHP-7.4:
  Fix leak on assign concat of array and empty string
diff --git a/Zend/tests/assign_concat_array_empty_string.phpt b/Zend/tests/assign_concat_array_empty_string.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Assign concat of array and empty string
+--FILE--
+<?php
+
+$a = [0];
+$a .= '';
+var_dump($a);
+
+?>
+--EXPECTF--
+Warning: Array to string conversion in %s on line %d
+string(5) "Array"
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
@@ -1861,6 +1861,9 @@ ZEND_API zend_result ZEND_FASTCALL concat_function(zval *result, zval *op1, zval
 		}
 	} else if (UNEXPECTED(Z_STRLEN_P(op2) == 0)) {
 		if (EXPECTED(result != op1)) {
+			if (result == orig_op1) {
+				i_zval_ptr_dtor(result);
+			}
 			ZVAL_COPY(result, op1);
 		}
 	} else {

Original file line number	Diff line number	Diff line change
`@@ -1861,6 +1861,9 @@ ZEND_API zend_result ZEND_FASTCALL concat_function(zval result, zval op1, zval`
`1861`	`1861`	`}`
`1862`	`1862`	`} else if (UNEXPECTED(Z_STRLEN_P(op2) == 0)) {`
`1863`	`1863`	`if (EXPECTED(result != op1)) {`
	`1864`	`+ if (result == orig_op1) {`
	`1865`	`+ i_zval_ptr_dtor(result);`
	`1866`	`+ }`
`1864`	`1867`	`ZVAL_COPY(result, op1);`
`1865`	`1868`	`}`
`1866`	`1869`	`} else {`