Fixed bug #34790 (preg_match_all(), named capturing groups, variable assignment/retur...

diff --git a/NEWS b/NEWS
index e8f9707723ab96e38e1a1a2ae6c482d0bc1644de..e36866f82c83d149c604da60e02573773eeda2fb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Oct 2005, Version 4.4.1
+- Fixed bug #34790 (preg_match_all(), named capturing groups, variable
+  assignment/return => crash). (Dmitry)
 - Fixed bug #34704 (Infinite recursion due to corrupt JPEG). (Marcus)
 - Fixed bug #33383 (crash when retrieving empty LOBs). (Tony)
        

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index f0d105921d2daacf9140202fac7aa298f951bfb5..748be13f1a1dbeb63a865f2c27748c2a6722c5b0 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -608,6 +608,7 @@ static void php_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global)
                        if (subpat_names[i]) {
                                zend_hash_update(Z_ARRVAL_P(subpats), subpat_names[i],
                                                                 strlen(subpat_names[i])+1, &match_sets[i], sizeof(zval *), NULL);
+                               ZVAL_ADDREF(match_sets[i]);
                        }
                        zend_hash_next_index_insert(Z_ARRVAL_P(subpats), &match_sets[i], sizeof(zval *), NULL);
                }

diff --git a/ext/pcre/tests/bug34790.phpt b/ext/pcre/tests/bug34790.phpt
new file mode 100755 (executable)
index 0000000..c375ae5
--- /dev/null
+++ b/ext/pcre/tests/bug34790.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #34790 (preg_match_all(), named capturing groups, variable assignment/return => crash)
+--FILE--
+<?php
+function func1(){
+        $string = 'what the word and the other word the';
+        preg_match_all('/(?P<word>the)/', $string, $matches);
+        return $matches['word'];
+}
+$words = func1();
+var_dump($words);
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  string(3) "the"
+  [1]=>
+  string(3) "the"
+  [2]=>
+  string(3) "the"
+  [3]=>
+  string(3) "the"
+}