Skip to content

Commit 2d0f39c

Browse files
GirgiasGirgias
committed
Fix leak
1 parent fb688b8 commit 2d0f39c

File tree

2 files changed

+74
-86
lines changed

2 files changed

+74
-86
lines changed

‎ext/bcmath/bcmath.c

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1260,16 +1260,16 @@ static int bcmath_number_compare(zval *op1, zval *op2)
12601260
bc_num n2 = NULL;
12611261

12621262
if (UNEXPECTED(bcmath_number_parse_num(op1, &obj1, &str1, &lval1) == FAILURE)) {
1263-
return ZEND_UNCOMPARABLE;
1263+
goto failure;
12641264
}
12651265

12661266
if (UNEXPECTED(bcmath_number_parse_num(op2, &obj2, &str2, &lval2) == FAILURE)) {
1267-
return ZEND_UNCOMPARABLE;
1267+
goto failure;
12681268
}
12691269

12701270
if (UNEXPECTED(bc_num_from_obj_or_str_or_long(&n1, NULL, obj1, str1, lval1) == FAILURE ||
12711271
bc_num_from_obj_or_str_or_long(&n2, NULL, obj2, str2, lval2) == FAILURE)) {
1272-
return ZEND_UNCOMPARABLE;
1272+
goto failure;
12731273
}
12741274

12751275
bcmath_compare_result ret = bc_compare(n1, n2, MAX(n1->n_scale, n2->n_scale));
@@ -1282,6 +1282,16 @@ static int bcmath_number_compare(zval *op1, zval *op2)
12821282
}
12831283

12841284
return (int) ret;
1285+
1286+
failure:
1287+
if (Z_TYPE_P(op1) != IS_OBJECT) {
1288+
bc_free_num(&n1);
1289+
}
1290+
1291+
if (Z_TYPE_P(op2) != IS_OBJECT) {
1292+
bc_free_num(&n2);
1293+
}
1294+
return ZEND_UNCOMPARABLE;
12851295
}
12861296

12871297
#define BCMATH_PARAM_NUMBER_OR_STR_OR_LONG(dest_obj, ce, dest_str, dest_long) \

‎ext/bcmath/tests/number/operators/compare_with_invalid_types.phpt

Lines changed: 61 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
BcMath\Number compare by operator with non-sense
33
--EXTENSIONS--
44
bcmath
5-
--XFAIL--
6-
Leaks and conversion issues
75
--FILE--
86
<?php
97

@@ -12,25 +10,26 @@ $values2 = [
1210
['string', 'string'],
1311
[new stdClass(), 'object'],
1412
[[], 'array'],
13+
[STDERR, 'resource'],
1514
];
1615

1716
$value1 = new BcMath\Number('100.0000');
1817

1918
foreach ($values2 as [$value2, $type2]) {
2019
try {
21-
echo "========== with {$type2} {$value2} ==========\n";
22-
echo "{$value1} > {$value2}: " . ($value1 > $value2 ? 'true' : 'false') . "\n";
23-
echo "{$value1} >= {$value2}: " . ($value1 >= $value2 ? 'true' : 'false') . "\n";
24-
echo "{$value1} == {$value2}: " . ($value1 == $value2 ? 'true' : 'false') . "\n";
25-
echo "{$value1} <= {$value2}: " . ($value1 <= $value2 ? 'true' : 'false') . "\n";
26-
echo "{$value1} < {$value2}: " . ($value1 < $value2 ? 'true' : 'false') . "\n";
20+
echo "========== with {$type2} ==========\n";
21+
echo "{$value1} > {$type2}: " . ($value1 > $value2 ? 'true' : 'false') . "\n";
22+
echo "{$value1} >= {$type2}: " . ($value1 >= $value2 ? 'true' : 'false') . "\n";
23+
echo "{$value1} == {$type2}: " . ($value1 == $value2 ? 'true' : 'false') . "\n";
24+
echo "{$value1} <= {$type2}: " . ($value1 <= $value2 ? 'true' : 'false') . "\n";
25+
echo "{$value1} < {$type2}: " . ($value1 < $value2 ? 'true' : 'false') . "\n";
2726

2827
echo "\ninversion\n";
29-
echo "{$value2} > {$value1}: " . ($value2 > $value1 ? 'true' : 'false') . "\n";
30-
echo "{$value2} >= {$value1}: " . ($value2 >= $value1 ? 'true' : 'false') . "\n";
31-
echo "{$value2} == {$value1}: " . ($value2 == $value1 ? 'true' : 'false') . "\n";
32-
echo "{$value2} <= {$value1}: " . ($value2 <= $value1 ? 'true' : 'false') . "\n";
33-
echo "{$value2} < {$value1}: " . ($value2 < $value1 ? 'true' : 'false') . "\n";
28+
echo "{$type2} > {$value1}: " . ($value2 > $value1 ? 'true' : 'false') . "\n";
29+
echo "{$type2} >= {$value1}: " . ($value2 >= $value1 ? 'true' : 'false') . "\n";
30+
echo "{$type2} == {$value1}: " . ($value2 == $value1 ? 'true' : 'false') . "\n";
31+
echo "{$type2} <= {$value1}: " . ($value2 <= $value1 ? 'true' : 'false') . "\n";
32+
echo "{$type2} < {$value1}: " . ($value2 < $value1 ? 'true' : 'false') . "\n";
3433

3534
echo "\n";
3635
} catch (Throwable $e) {
@@ -39,21 +38,21 @@ foreach ($values2 as [$value2, $type2]) {
3938
}
4039
?>
4140
--EXPECT--
42-
========== with null ==========
43-
100.0000 > : true
44-
100.0000 >= : true
45-
100.0000 == : false
46-
100.0000 <= : false
47-
100.0000 < : false
41+
========== with null ==========
42+
100.0000 > null: true
43+
100.0000 >= null: true
44+
100.0000 == null: false
45+
100.0000 <= null: false
46+
100.0000 < null: false
4847

4948
inversion
50-
> 100.0000: false
51-
>= 100.0000: false
52-
== 100.0000: false
53-
<= 100.0000: true
54-
< 100.0000: true
49+
null > 100.0000: false
50+
null >= 100.0000: false
51+
null == 100.0000: false
52+
null <= 100.0000: true
53+
null < 100.0000: true
5554

56-
========== with string string ==========
55+
========== with string ==========
5756
100.0000 > string: false
5857
100.0000 >= string: false
5958
100.0000 == string: false
@@ -67,65 +66,44 @@ string == 100.0000: false
6766
string <= 100.0000: false
6867
string < 100.0000: false
6968

70-
Error: Object of class stdClass could not be converted to string
71-
72-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 14
73-
========== with array Array ==========
74-
75-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 15
76-
100.0000 > Array: false
77-
78-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 16
79-
100.0000 >= Array: false
80-
81-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 17
82-
100.0000 == Array: false
83-
84-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 18
85-
100.0000 <= Array: false
86-
87-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 19
88-
100.0000 < Array: false
69+
========== with object ==========
70+
100.0000 > object: false
71+
100.0000 >= object: false
72+
100.0000 == object: false
73+
100.0000 <= object: false
74+
100.0000 < object: false
8975

9076
inversion
77+
object > 100.0000: false
78+
object >= 100.0000: false
79+
object == 100.0000: false
80+
object <= 100.0000: false
81+
object < 100.0000: false
82+
83+
========== with array ==========
84+
100.0000 > array: false
85+
100.0000 >= array: false
86+
100.0000 == array: false
87+
100.0000 <= array: false
88+
100.0000 < array: false
9189

92-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 22
93-
Array > 100.0000: false
94-
95-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 23
96-
Array >= 100.0000: false
97-
98-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 24
99-
Array == 100.0000: false
100-
101-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 25
102-
Array <= 100.0000: false
103-
104-
Warning: Array to string conversion in /home/girgias/dev/php-src/ext/bcmath/tests/number/operators/compare_with_invalid_types.php on line 26
105-
Array < 100.0000: false
106-
107-
108-
=================================================================
109-
==563635==ERROR: LeakSanitizer: detected memory leaks
110-
111-
Direct leak of 40 byte(s) in 1 object(s) allocated from:
112-
#0 0x69e593 in malloc (/home/girgias/dev/php-src/sapi/cli/php+0x69e593) (BuildId: 2f7a6003d470bd5f737972d1b6f5e078f877bdbe)
113-
#1 0x16e0183 in __zend_malloc /home/girgias/dev/php-src/Zend/zend_alloc.c:3280:14
114-
#2 0x9c18a9 in _bc_new_num_nonzeroed_ex_internal /home/girgias/dev/php-src/ext/bcmath/libbcmath/src/init.c:50:10
115-
#3 0x9c114b in _bc_new_num_ex /home/girgias/dev/php-src/ext/bcmath/libbcmath/src/init.c:64:16
116-
#4 0x9c1cdd in bc_init_numbers /home/girgias/dev/php-src/ext/bcmath/libbcmath/src/init.c:93:16
117-
#5 0x9a20ed in zm_globals_ctor_bcmath /home/girgias/dev/php-src/ext/bcmath/bcmath.c:105:2
118-
#6 0x147516b in tsrm_update_active_threads /home/girgias/dev/php-src/TSRM/TSRM.c:265:7
119-
#7 0x1474cab in ts_allocate_id /home/girgias/dev/php-src/TSRM/TSRM.c:306:2
120-
#8 0x170320b in zend_startup_module_ex /home/girgias/dev/php-src/Zend/zend_API.c:2422:3
121-
#9 0x1704f01 in zend_startup_module_zval /home/girgias/dev/php-src/Zend/zend_API.c:2446:10
122-
#10 0x1b577d2 in zend_hash_apply /home/girgias/dev/php-src/Zend/zend_hash.c:2085:13
123-
#11 0x1704aeb in zend_startup_modules /home/girgias/dev/php-src/Zend/zend_API.c:2569:2
124-
#12 0x148c070 in php_module_startup /home/girgias/dev/php-src/main/main.c:2290:2
125-
#13 0x1d3b3c8 in php_cli_startup /home/girgias/dev/php-src/sapi/cli/php_cli.c:397:9
126-
#14 0x1d36aa6 in main /home/girgias/dev/php-src/sapi/cli/php_cli.c:1276:6
127-
#15 0x7fc9982b9087 in __libc_start_call_main (/lib64/libc.so.6+0x2a087) (BuildId: 77c77fee058b19c6f001cf2cb0371ce3b8341211)
128-
#16 0x7fc9982b914a in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x2a14a) (BuildId: 77c77fee058b19c6f001cf2cb0371ce3b8341211)
129-
#17 0x603744 in _start (/home/girgias/dev/php-src/sapi/cli/php+0x603744) (BuildId: 2f7a6003d470bd5f737972d1b6f5e078f877bdbe)
90+
inversion
91+
array > 100.0000: false
92+
array >= 100.0000: false
93+
array == 100.0000: false
94+
array <= 100.0000: false
95+
array < 100.0000: false
96+
97+
========== with resource ==========
98+
100.0000 > resource: false
99+
100.0000 >= resource: false
100+
100.0000 == resource: false
101+
100.0000 <= resource: false
102+
100.0000 < resource: false
130103

131-
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
104+
inversion
105+
resource > 100.0000: false
106+
resource >= 100.0000: false
107+
resource == 100.0000: false
108+
resource <= 100.0000: false
109+
resource < 100.0000: false

0 commit comments

Comments
 (0)