MF51:

fix leak in zend_strtod() on big doubles
add new test

Zend/tests/zend_strtod.phpt

@@ -0,0 +1,17 @@
+--TEST--
+zend_strtod() leaks on big doubles
+--FILE--
+<?php
+var_dump("1139932690.21688500" - "1139932790.21688500");
+var_dump("1139932690000.21688500" - "331139932790.21688500");
+var_dump("339932690.21688500" - "4564645646456463461139932790.21688500");
+var_dump("123123139932690.21688500" - "11399327900000000.21688500");
+
+echo "Done\n";
+?>
+--EXPECTF--	
+float(-100)
+float(808792757210)
+float(-4.5646456464565E+27)
+float(-11276204760067000)
+Done

Zend/zend_strtod.c

@@ -1252,7 +1252,7 @@ zend_strtod
 	_double rv, rv0;
 	Long L;
 	ULong y, z;
-	Bigint *bb, *bb1, *bd, *bd0, *bs, *delta;
+	Bigint *bb, *bb1, *bd, *bd0, *bs, *delta, *tmp;
 	double result;
 
 	CONST char decimal_point = '.';
@@ -1778,6 +1778,22 @@ zend_strtod
 	if (se)
 		*se = (char *)s;
 	result = sign ? -value(rv) : value(rv);
+		
+	for (i = 0; i <= Kmax; i++) {
+		Bigint **listp = &freelist[i];
+		while ((tmp = *listp) != NULL) {
+			*listp = tmp->next;
+			free(tmp);
+		}
+		freelist[i] = NULL;
+	}
+	
+	while (p5s) {
+		tmp = p5s;
+		p5s = p5s->next;
+		free(tmp);
+	}
+	
 	return result;
 	}