Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)

diff --git a/NEWS b/NEWS
index c568a8d9693ba422e4a69ef10d4de58482cfc88e..1244197137fcf6079b6c76e2a86c6fde64c29ac2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, Version 4.4.1
+- Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
 - Fixed bug #33690 (Crash setting some ini directives in httpd.conf). (Rasmus)
 - Fixed bug #33673 (Added detection for partially uploaded files). (Ilia)
 - Fixed bug #33648 (Using --with-regex=system causes compile failure). (Andrei)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 2ceef88b7f92499f9cbf6eaada9c294c1eb781e3..7637e245524af17eb8a0e5e61b6dc7099f4dcf50 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1300,11 +1300,11 @@ PHP_FUNCTION(extract)
                                        zval **orig_var;
 
                                        if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
-                                               zval_ptr_dtor(orig_var);
-
                                                SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
                                                zval_add_ref(entry);
                                                
+                                               zval_ptr_dtor(orig_var);
+
                                                *orig_var = *entry;
                                        } else {
                                                if ((*var_array)->refcount > 1) {

diff --git a/ext/standard/tests/array/bug33989.phpt b/ext/standard/tests/array/bug33989.phpt
new file mode 100755 (executable)
index 0000000..ccef172
--- /dev/null
+++ b/ext/standard/tests/array/bug33989.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP)
+--FILE--
+<?php
+$a="a";
+extract($GLOBALS, EXTR_REFS);
+echo "ok\n";
+?>
+--EXPECT--
+ok