Fixed bug #48643 (String functions memory issue)

NEWS

@@ -1,6 +1,7 @@
-PHP                                                                        NEWS
+PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2009, PHP 5.3.0 RC 5
+- Fixed bug #48643 (String functions memory issue). (Dmitry)
 - Fixed bug #48641 (tmpfile() uses old parameter parsing).
   (crrodriguez at opensuse dot org)
 - Fixed bug #48624 (.user.ini never gets parsed). (Pierre)

ext/spl/spl_directory.c

@@ -1604,13 +1604,34 @@ static int spl_filesystem_object_cast(zval *readobj, zval *writeobj, int type TS
 		switch (intern->type) {
 		case SPL_FS_INFO:
 		case SPL_FS_FILE:
-			ZVAL_STRINGL(writeobj, intern->file_name, intern->file_name_len, 1);
+			if (readobj == writeobj) {
+				zval retval;
+				zval *retval_ptr = &retval;
+
+				ZVAL_STRINGL(retval_ptr, intern->file_name, intern->file_name_len, 1);
+				zval_dtor(readobj);
+				ZVAL_ZVAL(writeobj, retval_ptr, 0, 0);
+			} else {
+				ZVAL_STRINGL(writeobj, intern->file_name, intern->file_name_len, 1);
+			}
 			return SUCCESS;
 		case SPL_FS_DIR:
-			ZVAL_STRING(writeobj, intern->u.dir.entry.d_name, 1);
+			if (readobj == writeobj) {
+				zval retval;
+				zval *retval_ptr = &retval;
+
+				ZVAL_STRING(retval_ptr, intern->u.dir.entry.d_name, 1);
+				zval_dtor(readobj);
+				ZVAL_ZVAL(writeobj, retval_ptr, 0, 0);
+			} else {
+				ZVAL_STRING(writeobj, intern->u.dir.entry.d_name, 1);
+			}
 			return SUCCESS;
 		}
 	}
+	if (readobj == writeobj) {
+		zval_dtor(readobj);
+	}
 	ZVAL_NULL(writeobj);
 	return FAILURE;
 }