[lazerg]

When the name matches a compiled variable, zend_set_local_var() overwrote the slot without releasing what was already there, so any refcounted value in that CV leaked. zend_set_local_var_str() and the symbol table path both dtor the old value already, this does the same.

There is no in-tree caller of zend_set_local_var(), so I checked it by temporarily switching the $http_response_header write in the http wrapper over to it: two file_get_contents() calls in one function leak 8 blocks on a debug build before this change and none after.

Fixes #24668

[devnexen]

so literally reporter version ... the commit needs at least Co-Authored-by tag.

[lazerg]

Sorry for that, added now

[ndossche]

Can you add a test please, and can you check whether we need to protect the engine by using the zval garbage; trick or a safe_assign function ?

[lazerg]

Added a zend_test helper and a test. It does need the garbage trick: a destructor calling debug_backtrace() could read the freed old value from the CV, and zend_set_local_var_str() had the same problem (reachable through $http_response_header), so both now store the new value before releasing the old one.

[ndossche]

Good.
Who is yasu20200121web-prog btw?

[lazerg]

They opened GH-24668, and the first version of this fix was the patch they suggested there, so I credited them as co-author.