- Bugfix #29493 (extract(array, EXTR_REFS) misbehaves with elements referred

  twice or more times)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index f1e957f062e7a4b9daab5fc3e3ece6e679a05a6d..2b6f205a1187ca74c6515016f758d75961d41eac 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1375,13 +1375,16 @@ PHP_FUNCTION(extract)
                                if (extract_refs) {
                                        zval **orig_var;
 
-                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
-                                       zval_add_ref(entry);
-
                                        if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
                                                zval_ptr_dtor(orig_var);
+
+                                               SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+                                               zval_add_ref(entry);
+                                               
                                                *orig_var = *entry;
                                        } else {
+                                               (*entry)->is_ref = 1;
+                                               zval_add_ref(entry);
                                                zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
                                        }
                                } else {