diff --git a/NEWS b/NEWS index 57d6e4694d07..8c33cf869c4c 100644 --- a/NEWS +++ b/NEWS @@ -36,6 +36,8 @@ PHP NEWS (Marti2203). . Fixed bug GH-24989 (Use-after-free in GC when an exception is thrown). (David Carlier) + . Fixed memory leak of a duplicate named argument in new in initializer. + (Jorg Sowa) - CLI: . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work). diff --git a/Zend/tests/constexpr/new_named_params_duplicate_leak.phpt b/Zend/tests/constexpr/new_named_params_duplicate_leak.phpt new file mode 100644 index 000000000000..244b670ab1c6 --- /dev/null +++ b/Zend/tests/constexpr/new_named_params_duplicate_leak.phpt @@ -0,0 +1,21 @@ +--TEST-- +Duplicate named param in new in const expr does not leak the argument +--FILE-- +getMessage(), "\n"; +} + +?> +--EXPECT-- +Error: Named parameter $a overwrites previous argument diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c index 4e640a321d1f..6076a562c9dc 100644 --- a/Zend/zend_ast.c +++ b/Zend/zend_ast.c @@ -942,6 +942,7 @@ ZEND_API zend_result ZEND_FASTCALL zend_ast_evaluate_inner( zend_throw_error(NULL, "Named parameter $%s overwrites previous argument", ZSTR_VAL(name)); + zval_ptr_dtor(&arg); zend_array_destroy(args); zval_ptr_dtor(result); return FAILURE;